Overview

overview

10

Static

static

7

NEAS.d78a3...40.exe

windows7-x64

10

NEAS.d78a3...40.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    06-11-2023 23:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.d78a3edd5ae225662e842072633ba040.exe

  • Size

    176KB

  • MD5

    d78a3edd5ae225662e842072633ba040

  • SHA1

    73b3b8df28970a5baa9126170805b79ea955614a

  • SHA256

    c972f2316fe17c6b564f367d7b97f6928f51cea1919b9f8803bb034a797ed0fa

  • SHA512

    e13ca92ddd2b318f67338519e29edc6fbd65ef818e7ef5bed9f558f71acab212c16526c92a8d802bad5e30825d162f6d0787bc2db38fc2492781598727c682c4

  • SSDEEP

    768:Ac/TbblFpQNwC3BEc4QEfu0Ei8XxNDI/vFaaz6JZ1Ssw63BEfA:x7bbl/eThavEjDUvFaaAXZL0A

Score
10/10
evasionupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d78a3edd5ae225662e842072633ba040.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d78a3edd5ae225662e842072633ba040.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\484097239\backup.exe
      C:\Users\Admin\AppData\Local\Temp\484097239\backup.exe C:\Users\Admin\AppData\Local\Temp\484097239\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:436
          • C:\PerfLogs\Admin\update.exe
            C:\PerfLogs\Admin\update.exe C:\PerfLogs\Admin\
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:2892
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:900
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1080
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1872
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2088
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1992
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1332
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:2128
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:764
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:952
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2292
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:740
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2944
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2212
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2440
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1920
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • System policy modification
                  PID:2424
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1580
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2700
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1464
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2624
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2652
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2248
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2536
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2564
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3044
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2832
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2756
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1164
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:296
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:436
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1708
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1116
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:568
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2844
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2064
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1604
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2976
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2272
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2332
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1572
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:628
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1532
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1996
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1596
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1348
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:844
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1520
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1616
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1928
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:300
                • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1692
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2408
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2400
              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:2640
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                  8⤵
                    PID:2776
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                    8⤵
                    • System policy modification
                    PID:2780
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                    8⤵
                      PID:2748
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                      8⤵
                        PID:2764
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                        8⤵
                          PID:1632
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:2500
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                        7⤵
                          PID:3060
                          • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                            8⤵
                            • System policy modification
                            PID:2472
                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                          7⤵
                            PID:664
                          • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                            7⤵
                            • System policy modification
                            PID:3044
                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                            7⤵
                            • Drops file in Program Files directory
                            PID:2920
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                              8⤵
                                PID:2932
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:1464
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                                8⤵
                                • System policy modification
                                PID:1816
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                                8⤵
                                  PID:1284
                                • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                                  8⤵
                                    PID:1848
                                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:2860
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                  7⤵
                                  • Drops file in Program Files directory
                                  PID:760
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:1080
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System policy modification
                                    PID:588
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                                    8⤵
                                    • System policy modification
                                    PID:2036
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
                                    8⤵
                                      PID:1964
                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:1368
                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\System Restore.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:1544
                                  • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                    7⤵
                                      PID:2116
                                    • C:\Program Files\Common Files\Microsoft Shared\VGX\System Restore.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\VGX\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                      7⤵
                                        PID:1524
                                      • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                        7⤵
                                          PID:820
                                          • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\data.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:996
                                            • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
                                              9⤵
                                              • System policy modification
                                              PID:308
                                      • C:\Program Files\Common Files\Services\backup.exe
                                        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:2348
                                      • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                        "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                        6⤵
                                          PID:1296
                                          • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                            "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:1724
                                        • C:\Program Files\Common Files\System\backup.exe
                                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                          6⤵
                                          • Drops file in Program Files directory
                                          • System policy modification
                                          PID:1700
                                          • C:\Program Files\Common Files\System\ado\backup.exe
                                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                            7⤵
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:2124
                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:2716
                                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                              8⤵
                                              • System policy modification
                                              PID:2464
                                            • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                              "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:2540
                                            • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:2936
                                            • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                              "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                              8⤵
                                              • System policy modification
                                              PID:112
                                            • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                              8⤵
                                                PID:1916
                                            • C:\Program Files\Common Files\System\de-DE\backup.exe
                                              "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                              7⤵
                                              • System policy modification
                                              PID:788
                                            • C:\Program Files\Common Files\System\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:2008
                                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System policy modification
                                              PID:740
                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                              7⤵
                                              • System policy modification
                                              PID:872
                                            • C:\Program Files\Common Files\System\it-IT\backup.exe
                                              "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                              7⤵
                                              • System policy modification
                                              PID:2644
                                            • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                              7⤵
                                                PID:3036
                                              • C:\Program Files\Common Files\System\msadc\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                7⤵
                                                • Drops file in Program Files directory
                                                • System policy modification
                                                PID:2840
                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                  8⤵
                                                  • System policy modification
                                                  PID:1396
                                                • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                  8⤵
                                                  • System policy modification
                                                  PID:540
                                                • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                  8⤵
                                                  • System policy modification
                                                  PID:1708
                                                • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  PID:2056
                                                • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                  8⤵
                                                    PID:1716
                                                  • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                    8⤵
                                                      PID:1784
                                                  • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                    "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                    7⤵
                                                    • System policy modification
                                                    PID:2424
                                                    • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                      "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                      8⤵
                                                        PID:2320
                                                      • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                        "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                        8⤵
                                                          PID:1684
                                                        • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                          8⤵
                                                            PID:1988
                                                          • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                            "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                            8⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:2496
                                                          • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                            "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                            8⤵
                                                              PID:1104
                                                            • C:\Program Files\Common Files\System\Ole DB\ja-JP\update.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\ja-JP\update.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                              8⤵
                                                                PID:2052
                                                        • C:\Program Files\DVD Maker\backup.exe
                                                          "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                          5⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Drops file in Program Files directory
                                                          • System policy modification
                                                          PID:2696
                                                          • C:\Program Files\DVD Maker\de-DE\data.exe
                                                            "C:\Program Files\DVD Maker\de-DE\data.exe" C:\Program Files\DVD Maker\de-DE\
                                                            6⤵
                                                              PID:2608
                                                            • C:\Program Files\DVD Maker\en-US\backup.exe
                                                              "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                              6⤵
                                                                PID:2192
                                                              • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:2940
                                                              • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:1236
                                                              • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:1188
                                                              • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                6⤵
                                                                  PID:2372
                                                                • C:\Program Files\DVD Maker\Shared\backup.exe
                                                                  "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Drops file in Program Files directory
                                                                  PID:2012
                                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                                    7⤵
                                                                    • Drops file in Program Files directory
                                                                    PID:1616
                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                                      8⤵
                                                                        PID:2256
                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                                        8⤵
                                                                          PID:2504
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System policy modification
                                                                          PID:3040
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
                                                                          8⤵
                                                                          • System policy modification
                                                                          PID:2880
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
                                                                          8⤵
                                                                            PID:2492
                                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
                                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
                                                                            8⤵
                                                                              PID:1284
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System policy modification
                                                                              PID:1164
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
                                                                              8⤵
                                                                                PID:2176
                                                                              • C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
                                                                                "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System policy modification
                                                                                PID:1812
                                                                              • C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
                                                                                "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
                                                                                8⤵
                                                                                  PID:2368
                                                                                • C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
                                                                                  "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
                                                                                  8⤵
                                                                                    PID:1916
                                                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\update.exe
                                                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
                                                                                    8⤵
                                                                                      PID:2280
                                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
                                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
                                                                                      8⤵
                                                                                      • System policy modification
                                                                                      PID:2132
                                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
                                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
                                                                                      8⤵
                                                                                        PID:2784
                                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
                                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
                                                                                        8⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        PID:2084
                                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
                                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
                                                                                        8⤵
                                                                                          PID:1752
                                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
                                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
                                                                                          8⤵
                                                                                            PID:2236
                                                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
                                                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • System policy modification
                                                                                            PID:2388
                                                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
                                                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
                                                                                            8⤵
                                                                                              PID:1800
                                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
                                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
                                                                                              8⤵
                                                                                                PID:2776
                                                                                        • C:\Program Files\Google\backup.exe
                                                                                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                          5⤵
                                                                                            PID:2292
                                                                                            • C:\Program Files\Google\Chrome\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                              6⤵
                                                                                                PID:2704
                                                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                              5⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:2600
                                                                                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                6⤵
                                                                                                  PID:2924
                                                                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                  6⤵
                                                                                                    PID:1780
                                                                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                    6⤵
                                                                                                    • System policy modification
                                                                                                    PID:2408
                                                                                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                    6⤵
                                                                                                      PID:3028
                                                                                                    • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                      6⤵
                                                                                                        PID:1968
                                                                                                      • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                        6⤵
                                                                                                          PID:2416
                                                                                                        • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                          "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                          6⤵
                                                                                                            PID:2848
                                                                                                          • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                            "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                            6⤵
                                                                                                              PID:1916
                                                                                                          • C:\Program Files\Java\backup.exe
                                                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                            5⤵
                                                                                                              PID:1796
                                                                                                            • C:\Program Files\Microsoft Games\backup.exe
                                                                                                              "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                                              5⤵
                                                                                                                PID:820
                                                                                                              • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                5⤵
                                                                                                                  PID:1576
                                                                                                                • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                  5⤵
                                                                                                                    PID:296
                                                                                                                  • C:\Program Files\MSBuild\backup.exe
                                                                                                                    "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                                                    5⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • System policy modification
                                                                                                                    PID:1252
                                                                                                                    • C:\Program Files\MSBuild\Microsoft\backup.exe
                                                                                                                      "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
                                                                                                                      6⤵
                                                                                                                        PID:2248
                                                                                                                    • C:\Program Files\Reference Assemblies\backup.exe
                                                                                                                      "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                                                                      5⤵
                                                                                                                        PID:1764
                                                                                                                      • C:\Program Files\VideoLAN\backup.exe
                                                                                                                        "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
                                                                                                                        5⤵
                                                                                                                          PID:2844
                                                                                                                        • C:\Program Files\Windows Defender\update.exe
                                                                                                                          "C:\Program Files\Windows Defender\update.exe" C:\Program Files\Windows Defender\
                                                                                                                          5⤵
                                                                                                                            PID:1308
                                                                                                                          • C:\Program Files\Windows Journal\backup.exe
                                                                                                                            "C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
                                                                                                                            5⤵
                                                                                                                              PID:2196
                                                                                                                          • C:\Program Files (x86)\backup.exe
                                                                                                                            "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                            4⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:2188
                                                                                                                            • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                              5⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:1312
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                                                                6⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:1556
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                                                  7⤵
                                                                                                                                  • System policy modification
                                                                                                                                  PID:2676
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                                                  7⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:2604
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                                                    8⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • System policy modification
                                                                                                                                    PID:2184
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                                                    8⤵
                                                                                                                                    • System policy modification
                                                                                                                                    PID:2900
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                                                    8⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:1192
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                                                    8⤵
                                                                                                                                      PID:1116
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                                                        9⤵
                                                                                                                                          PID:2084
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                                                        8⤵
                                                                                                                                          PID:2328
                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                                                          8⤵
                                                                                                                                            PID:1124
                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                                                              9⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • System policy modification
                                                                                                                                              PID:1524
                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                                                            8⤵
                                                                                                                                              PID:2456
                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                                                              8⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:300
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
                                                                                                                                                9⤵
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:2208
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                  10⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:2720
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
                                                                                                                                                9⤵
                                                                                                                                                  PID:2748
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                    10⤵
                                                                                                                                                      PID:2740
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
                                                                                                                                                    9⤵
                                                                                                                                                      PID:1744
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
                                                                                                                                                      9⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:2864
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
                                                                                                                                                        10⤵
                                                                                                                                                          PID:3008
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                                                                      8⤵
                                                                                                                                                        PID:2440
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
                                                                                                                                                          9⤵
                                                                                                                                                            PID:2464
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                                                                          8⤵
                                                                                                                                                            PID:2760
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                                                                            8⤵
                                                                                                                                                              PID:2396
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                                                            7⤵
                                                                                                                                                              PID:1672
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:1604
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                                                                7⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                PID:2500
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:2588
                                                                                                                                                            • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                              5⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              PID:1224
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                6⤵
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                PID:2416
                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:1456
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:2872
                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                                                                                                      7⤵
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:2080
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1036
                                                                                                                                                                    • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:272
                                                                                                                                                                      • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                                                                        6⤵
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:832
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:920
                                                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:2712
                                                                                                                                                                            • C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:876
                                                                                                                                                                              • C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:2260
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:340
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:2708
                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:2200
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:2940
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1340
                                                                                                                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      PID:2256
                                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                      PID:1464
                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:340
                                                                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:2840
                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:1692
                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:1792
                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:1736
                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:1860
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\System Restore.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft Office\System Restore.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft Office\System Restore.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:3032
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:1848
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft.NET\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                      • C:\Users\backup.exe
                                                                                                                                                                                                                        C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                          • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                            C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:2104
                                                                                                                                                                                                                            • C:\Users\Public\backup.exe
                                                                                                                                                                                                                              C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                  C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:664
                                                                                                                                                                                                                                  • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                    C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                    • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:844
                                                                                                                                                                                                                                      • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                                                        • C:\Users\Public\Recorded TV\backup.exe
                                                                                                                                                                                                                                          "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                                          • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                            C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                                        • C:\Windows\backup.exe
                                                                                                                                                                                                                                          C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                          PID:2664
                                                                                                                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                                                            • C:\Windows\AppCompat\backup.exe
                                                                                                                                                                                                                                              C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                                              • C:\Windows\AppPatch\backup.exe
                                                                                                                                                                                                                                                C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                • C:\Windows\AppPatch\AppPatch64\backup.exe
                                                                                                                                                                                                                                                  C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                                                                  • C:\Windows\AppPatch\Custom\backup.exe
                                                                                                                                                                                                                                                    C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                    • C:\Windows\AppPatch\de-DE\backup.exe
                                                                                                                                                                                                                                                      C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:836
                                                                                                                                                                                                                                                      • C:\Windows\AppPatch\en-US\backup.exe
                                                                                                                                                                                                                                                        C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                      • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                        C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:564
                                                                                                                                                                                                                                                        • C:\Windows\Branding\backup.exe
                                                                                                                                                                                                                                                          C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:1924
                                                                                                                                                                                                                                                          • C:\Windows\CSC\backup.exe
                                                                                                                                                                                                                                                            C:\Windows\CSC\backup.exe C:\Windows\CSC\
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:1012
                                                                                                                                                                                                                                                            • C:\Windows\Cursors\backup.exe
                                                                                                                                                                                                                                                              C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                                                                              • C:\Windows\debug\backup.exe
                                                                                                                                                                                                                                                                C:\Windows\debug\backup.exe C:\Windows\debug\
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:1612
                                                                                                                                                                                                                                                                • C:\Windows\de-DE\System Restore.exe
                                                                                                                                                                                                                                                                  "C:\Windows\de-DE\System Restore.exe" C:\Windows\de-DE\
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:1352
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:2708
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                              PID:2784
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:2540
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:2296

                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                          • C:\PerfLogs\Admin\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            67eb7b135d0bccd3d112856c324e9dce

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            859f75feb68033fdd65644c119d128f49636a7d2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9f734f814d512a5cb1914083ca2cbd364bcc1f09b9d989f6565fda53cf9dbd3a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4ea6c0ee047ff3956690ecfddaec32e9568d588a33f7b27995044adaea55204da69ac56a12c2c334fc0b0f1790e35bd2c1924137a5ce787c69f041e564d07f31

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\PerfLogs\Admin\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            67eb7b135d0bccd3d112856c324e9dce

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            859f75feb68033fdd65644c119d128f49636a7d2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9f734f814d512a5cb1914083ca2cbd364bcc1f09b9d989f6565fda53cf9dbd3a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4ea6c0ee047ff3956690ecfddaec32e9568d588a33f7b27995044adaea55204da69ac56a12c2c334fc0b0f1790e35bd2c1924137a5ce787c69f041e564d07f31

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\PerfLogs\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\PerfLogs\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            262f774be032edbd12e2286ed28f3807

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            7a1a25ca396b21003c0d5b404746b681cf81b29d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            510b3f0df53ef91c722768e464b7fba6510a1b03e5af7de16901652d3e7d6596

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            13dc0ff16032a3055c38513c028bf5f994102189e80bedf497d1297e8313f00f34e46ce4aaf98351dbe7b05078baa1b8ec8f8a05f084b29ad9fccf4fbeea5016

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Program Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\484097239\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7842986cceaf0ea92f19572f19e17acb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            066d80c4a1d2b4fbd029458e86b2ee479e610c14

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            501fa60362542c1e4d6a3e31fb1884862eeae1385c67a983ccab4c8fd5974f55

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd147f4176f3f652df8b1fa59ac7ce700db4e45a690acf46af54d25ab7dcc5b662f84f54281c48583e5c9047f53a410693328f7571e62267e5ff4d88db2de781

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\484097239\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7842986cceaf0ea92f19572f19e17acb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            066d80c4a1d2b4fbd029458e86b2ee479e610c14

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            501fa60362542c1e4d6a3e31fb1884862eeae1385c67a983ccab4c8fd5974f55

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd147f4176f3f652df8b1fa59ac7ce700db4e45a690acf46af54d25ab7dcc5b662f84f54281c48583e5c9047f53a410693328f7571e62267e5ff4d88db2de781

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\484097239\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7842986cceaf0ea92f19572f19e17acb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            066d80c4a1d2b4fbd029458e86b2ee479e610c14

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            501fa60362542c1e4d6a3e31fb1884862eeae1385c67a983ccab4c8fd5974f55

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd147f4176f3f652df8b1fa59ac7ce700db4e45a690acf46af54d25ab7dcc5b662f84f54281c48583e5c9047f53a410693328f7571e62267e5ff4d88db2de781

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            21e8f7b29d9912cd495d5ca1ebbe4ff4

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            67c5ec718cac8dfac303ba2fbb64ed9bef0b94e6

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a649c895eb2c313a744035fd556a0df88b714f7ab793a1ff1468e08d7e183eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e3c0f520b8dbaf370449466a594487f3657388d19b000b93ba000f58016942a6ee99b6062760456d5df8666819da44de732449ed1e2d05f2ed823613f448405d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.zip
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            22B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            76cdb2bad9582d23c1f6f4d868218d6c

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.zip
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            33KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            91a6f1d7b3112c16fd57e8d47b829d83

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            244540c81677979b6c19e5b38a1dd20f9e9eeb6b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            47346f1a82fcc863e01546bb5314630ed8396179818471a973835b7b2ede4f08

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            8923983949ac20d0845907efdc6a662dc866d7f331e054694d5943d0d974d4549baf7652b7635cdb30cd7050f5b15ea7bbd822dc316985f0a030c78ff454a55e

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            ea005a1748ebbf3e50338f9b35996570

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            cd5027097b9ce2937d3885514f89c6684983a016

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            2ec8d5e87612b340aad3e524378318385d3e9ed16222ce5b395a51df36e4a356

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            61d24bd47944e7b561d5326b5ffe3df36c3bfc045ad93993ca033c72415870fa1c61de347fbfeced4374246126d7a04955dbcbf23b410bae08171c55ba5da9f1

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            ea005a1748ebbf3e50338f9b35996570

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            cd5027097b9ce2937d3885514f89c6684983a016

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            2ec8d5e87612b340aad3e524378318385d3e9ed16222ce5b395a51df36e4a356

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            61d24bd47944e7b561d5326b5ffe3df36c3bfc045ad93993ca033c72415870fa1c61de347fbfeced4374246126d7a04955dbcbf23b410bae08171c55ba5da9f1

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \PerfLogs\Admin\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            67eb7b135d0bccd3d112856c324e9dce

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            859f75feb68033fdd65644c119d128f49636a7d2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9f734f814d512a5cb1914083ca2cbd364bcc1f09b9d989f6565fda53cf9dbd3a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4ea6c0ee047ff3956690ecfddaec32e9568d588a33f7b27995044adaea55204da69ac56a12c2c334fc0b0f1790e35bd2c1924137a5ce787c69f041e564d07f31

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \PerfLogs\Admin\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            67eb7b135d0bccd3d112856c324e9dce

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            859f75feb68033fdd65644c119d128f49636a7d2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9f734f814d512a5cb1914083ca2cbd364bcc1f09b9d989f6565fda53cf9dbd3a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4ea6c0ee047ff3956690ecfddaec32e9568d588a33f7b27995044adaea55204da69ac56a12c2c334fc0b0f1790e35bd2c1924137a5ce787c69f041e564d07f31

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \PerfLogs\Admin\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            67eb7b135d0bccd3d112856c324e9dce

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            859f75feb68033fdd65644c119d128f49636a7d2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9f734f814d512a5cb1914083ca2cbd364bcc1f09b9d989f6565fda53cf9dbd3a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4ea6c0ee047ff3956690ecfddaec32e9568d588a33f7b27995044adaea55204da69ac56a12c2c334fc0b0f1790e35bd2c1924137a5ce787c69f041e564d07f31

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \PerfLogs\Admin\update.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            67eb7b135d0bccd3d112856c324e9dce

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            859f75feb68033fdd65644c119d128f49636a7d2

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            9f734f814d512a5cb1914083ca2cbd364bcc1f09b9d989f6565fda53cf9dbd3a

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            4ea6c0ee047ff3956690ecfddaec32e9568d588a33f7b27995044adaea55204da69ac56a12c2c334fc0b0f1790e35bd2c1924137a5ce787c69f041e564d07f31

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \PerfLogs\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \PerfLogs\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            b698368018b15e882b6cc903ce83f6c5

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            91445f0cad45e909b46aea698e031dcad0bd0f30

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            46b884096ed820d902cf47780885454ef23cb3330d3f993e0af43b8f93705ddb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cab8f6579552bfca8419e78d15dcb50a8073e13e087c93bcffd31ae3cf19407507f7f9377904f08cc4651d4323c3201620d2e1ff746b49563be71a92254d62c0

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            262f774be032edbd12e2286ed28f3807

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            7a1a25ca396b21003c0d5b404746b681cf81b29d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            510b3f0df53ef91c722768e464b7fba6510a1b03e5af7de16901652d3e7d6596

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            13dc0ff16032a3055c38513c028bf5f994102189e80bedf497d1297e8313f00f34e46ce4aaf98351dbe7b05078baa1b8ec8f8a05f084b29ad9fccf4fbeea5016

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            262f774be032edbd12e2286ed28f3807

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            7a1a25ca396b21003c0d5b404746b681cf81b29d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            510b3f0df53ef91c722768e464b7fba6510a1b03e5af7de16901652d3e7d6596

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            13dc0ff16032a3055c38513c028bf5f994102189e80bedf497d1297e8313f00f34e46ce4aaf98351dbe7b05078baa1b8ec8f8a05f084b29ad9fccf4fbeea5016

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            58797dc62e6b58d361c00c812c5879bd

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4c987e93d984b639e796d60f5051aa0953bb4e13

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            b48aa43a386541aada68a76fafd4baa661eef49ed08e2bb79e6f08b013c709da

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            c56ad8a405fe15be995b1dbdfc97dc9a3431c90a59c77683ed2c4a95fc50b41c4c1bb4f6027af888592149efc91d6f5ab118b1ee5bfea65121faf0da6c7a575b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d68343f43ee4d119eb79e3fcd198fb2a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            57b78546b01c9130c65d4bf3755699b2a34a11e8

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            cf8758e85accefd98c77e351cacf69e9eef8593d9c4a01362f0bf641470d2830

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            1e982b4e75c37fadef7249ada1c1cc0f5aea1882b5620073297dd01a1e311cffcd68608ee236416957531eb3eb04a03a23d89dce32520fa6002449227cb01e26

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            6e19d094ab691da4df5d266fcdb56ede

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            02acdc7af6375c4b5f578d3c5bd7026728bed76e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3085cbca82d75fca3c2a571912c70e625fc25d0616dbc71be11d15734236397

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            97054a1a7c03cce9c9db8a4be9ceb227c395b5c1b22039b6b0de2e0c6a45ca3b8ce02a3d1d30eebd76ebcbc5b22d137995ab1fd14a9ef9807e6982ec4d7db4d3

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Program Files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            94fc58ed19ed4256f0db0457d10c8248

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            2a44a4d8896a6c6e5d0b6af27d6ef44dd052e56e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            208d137fff6f86ae10e44c57f32ef9c665d6d5ead0c829169d773a81ad2a31eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            bdc80842c9136a3b7315af922dcd1858f5b97ecc3b1c29bc86efbba6555077c8cda33f35a946037b1bbf4953721c4f35765ac3ad46d794575b12b945c643fe60

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\484097239\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7842986cceaf0ea92f19572f19e17acb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            066d80c4a1d2b4fbd029458e86b2ee479e610c14

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            501fa60362542c1e4d6a3e31fb1884862eeae1385c67a983ccab4c8fd5974f55

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd147f4176f3f652df8b1fa59ac7ce700db4e45a690acf46af54d25ab7dcc5b662f84f54281c48583e5c9047f53a410693328f7571e62267e5ff4d88db2de781

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\484097239\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            7842986cceaf0ea92f19572f19e17acb

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            066d80c4a1d2b4fbd029458e86b2ee479e610c14

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            501fa60362542c1e4d6a3e31fb1884862eeae1385c67a983ccab4c8fd5974f55

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            cd147f4176f3f652df8b1fa59ac7ce700db4e45a690acf46af54d25ab7dcc5b662f84f54281c48583e5c9047f53a410693328f7571e62267e5ff4d88db2de781

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            21e8f7b29d9912cd495d5ca1ebbe4ff4

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            67c5ec718cac8dfac303ba2fbb64ed9bef0b94e6

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a649c895eb2c313a744035fd556a0df88b714f7ab793a1ff1468e08d7e183eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e3c0f520b8dbaf370449466a594487f3657388d19b000b93ba000f58016942a6ee99b6062760456d5df8666819da44de732449ed1e2d05f2ed823613f448405d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            21e8f7b29d9912cd495d5ca1ebbe4ff4

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            67c5ec718cac8dfac303ba2fbb64ed9bef0b94e6

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a649c895eb2c313a744035fd556a0df88b714f7ab793a1ff1468e08d7e183eb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            e3c0f520b8dbaf370449466a594487f3657388d19b000b93ba000f58016942a6ee99b6062760456d5df8666819da44de732449ed1e2d05f2ed823613f448405d

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            f78831e45c9809772208cb3917b3dc14

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            49b98a6d50eaeb2f37cf3aedd1b750d9364ac0cc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            8a52ab760e154de8b928e12b3b27be02e14ca9347f9d1827602e118537d5f7f3

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5e157ca526385508de804eca607e6add1e00782400f35bf849a73a7fbd8c24585e84bc8da8d7bd0483d9fb08c182061affd2a6997e019b8305e106b6efb7341a

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • memory/436-133-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/740-286-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/764-255-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/900-244-0x00000000002A0000-0x00000000002CC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/900-243-0x00000000002A0000-0x00000000002CC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/900-211-0x00000000002A0000-0x00000000002CC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/900-188-0x00000000002A0000-0x00000000002CC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/900-187-0x00000000002A0000-0x00000000002CC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/900-202-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-26-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-0-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-24-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-117-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-190-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-47-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-59-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-124-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-126-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-11-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1036-60-0x0000000000370000-0x000000000039C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1080-179-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1332-221-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1580-338-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1804-85-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1832-149-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1832-162-0x00000000003C0000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1832-107-0x00000000003C0000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1832-189-0x00000000003C0000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1832-151-0x00000000003C0000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1832-137-0x00000000003C0000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1872-178-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1992-229-0x00000000003B0000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1992-281-0x00000000003B0000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1992-217-0x00000000003B0000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1992-230-0x00000000003B0000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1992-271-0x00000000003B0000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1992-267-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2088-237-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2088-204-0x0000000000430000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2088-197-0x0000000000430000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2088-262-0x0000000000430000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2088-258-0x0000000000430000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2128-280-0x00000000002C0000-0x00000000002EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2128-248-0x00000000002C0000-0x00000000002EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2128-301-0x00000000002C0000-0x00000000002EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2128-283-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2128-291-0x00000000002C0000-0x00000000002EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2128-292-0x00000000002C0000-0x00000000002EC000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2212-305-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2292-276-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2296-108-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2300-72-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2300-13-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2424-325-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2424-336-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2440-313-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2540-76-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2624-361-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2628-64-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2700-347-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2708-29-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2784-51-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2892-134-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2944-296-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                                            Download