93dfa5d20ec19ccb31115a9f9464ccab26c7e9d870eeadaa149cc5aa691f1bed

Analysis

max time kernel
1s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
Size

122KB
MD5

6aa4cab201084532ac8a143c1eb38e00
SHA1

64b09bffa91436862e916c438f668a4f0a43e344
SHA256

93dfa5d20ec19ccb31115a9f9464ccab26c7e9d870eeadaa149cc5aa691f1bed
SHA512

0a2d0ca30f1a1c0813434461f9d7fc552b2700b89b9924b8b48f5739b22e7cab8415affb702595f8d669ddba832b04559711983ad01b3c1ccd6303136402eb09
SSDEEP

1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4s:6u8ANCUdgfmD7zey0KUj6TjR9i4s

Score

10^/10

dropper evasion persistence trojan

Malware Config

Signatures

Malware Backdoor - Berbew 64 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1720-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x000700000001625a-23.dat	family_berbew
behavioral1/files/0x00090000000167ef-35.dat	family_berbew
behavioral1/files/0x000b000000016611-46.dat	family_berbew
behavioral1/files/0x000b000000016611-42.dat	family_berbew
behavioral1/memory/2872-51-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1364-59-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016c1e-70.dat	family_berbew
behavioral1/files/0x0006000000016c1e-66.dat	family_berbew
behavioral1/memory/1364-64-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1720-83-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016c24-78.dat	family_berbew
behavioral1/memory/2532-86-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2368-77-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016c24-75.dat	family_berbew
behavioral1/files/0x0006000000016c24-82.dat	family_berbew
behavioral1/memory/2616-74-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x0027000000015dab-102.dat	family_berbew
behavioral1/memory/1720-109-0x00000000002A0000-0x00000000002C4000-memory.dmp	family_berbew
behavioral1/files/0x0010000000016adb-113.dat	family_berbew
behavioral1/files/0x0006000000016c9c-121.dat	family_berbew
behavioral1/files/0x0006000000016cd8-128.dat	family_berbew
behavioral1/memory/2760-135-0x0000000000390000-0x00000000003B4000-memory.dmp	family_berbew
behavioral1/memory/1524-140-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/768-149-0x0000000000260000-0x0000000000284000-memory.dmp	family_berbew
behavioral1/files/0x0007000000016ce0-156.dat	family_berbew
behavioral1/memory/1720-163-0x00000000002A0000-0x00000000002C4000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016cfd-167.dat	family_berbew
behavioral1/memory/2456-175-0x00000000002A0000-0x00000000002C4000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016d20-187.dat	family_berbew
behavioral1/memory/1472-186-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016d40-205.dat	family_berbew
behavioral1/memory/1956-215-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1376-213-0x0000000000280000-0x00000000002A4000-memory.dmp	family_berbew
behavioral1/memory/2312-218-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/files/0x0006000000016d66-225.dat	family_berbew
behavioral1/files/0x0006000000016d66-221.dat	family_berbew
behavioral1/memory/1956-237-0x0000000000320000-0x0000000000344000-memory.dmp	family_berbew
behavioral1/memory/2104-249-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2104-260-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/1376-263-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1332-266-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1376-279-0x0000000000280000-0x00000000002A4000-memory.dmp	family_berbew
behavioral1/memory/948-274-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2104-296-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2348-301-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2104-306-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/3020-320-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1560-335-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2104-349-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2104-356-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2804-360-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2640-368-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2084-376-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2496-385-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2104-390-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2112-394-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1288-426-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/1288-433-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral1/memory/2104-446-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2104-455-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2104-464-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew
behavioral1/memory/2104-473-0x0000000000300000-0x0000000000324000-memory.dmp	family_berbew

Modifies visibility of file extensions in Explorer 2 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Executes dropped EXE 7 IoCs

pid	Process
1720	backup.exe
1196	backup.exe
2700	backup.exe
2872	backup.exe
1364	backup.exe
2616	backup.exe
2532	backup.exe

Loads dropped DLL 14 IoCs

pid	Process
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
1720	backup.exe
1196	backup.exe
2700	backup.exe
2872	backup.exe
1364	backup.exe
2616	backup.exe
2532	backup.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1720	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	168
PID 2368 wrote to memory of 1720	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	168
PID 2368 wrote to memory of 1720	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	168
PID 2368 wrote to memory of 1720	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	168
PID 2368 wrote to memory of 1196	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	167
PID 2368 wrote to memory of 1196	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	167
PID 2368 wrote to memory of 1196	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	167
PID 2368 wrote to memory of 1196	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	167
PID 2368 wrote to memory of 2700	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	166
PID 2368 wrote to memory of 2700	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	166
PID 2368 wrote to memory of 2700	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	166
PID 2368 wrote to memory of 2700	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	166
PID 2368 wrote to memory of 2872	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	165
PID 2368 wrote to memory of 2872	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	165
PID 2368 wrote to memory of 2872	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	165
PID 2368 wrote to memory of 2872	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	165
PID 2368 wrote to memory of 1364	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	164
PID 2368 wrote to memory of 1364	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	164
PID 2368 wrote to memory of 1364	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	164
PID 2368 wrote to memory of 1364	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	164
PID 2368 wrote to memory of 2616	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	163
PID 2368 wrote to memory of 2616	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	163
PID 2368 wrote to memory of 2616	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	163
PID 2368 wrote to memory of 2616	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	163
PID 2368 wrote to memory of 2532	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	16
PID 2368 wrote to memory of 2532	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	16
PID 2368 wrote to memory of 2532	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	16
PID 2368 wrote to memory of 2532	2368	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe	16

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6aa4cab201084532ac8a143c1eb38e00.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\1009592410\backup.exe
  C:\Users\Admin\AppData\Local\Temp\1009592410\backup.exe C:\Users\Admin\AppData\Local\Temp\1009592410\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1720

C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
1⤵
PID:3052

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
1⤵
PID:1288
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:2804
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:2956
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
  2⤵
  PID:1948
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
  2⤵
  PID:1276
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:2708
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
  2⤵
  PID:2112
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
  2⤵
  PID:2496
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
  2⤵
  PID:2084
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
  2⤵
  PID:2640

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:1312

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:2976

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
1⤵
PID:2892

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:848

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
1⤵
PID:1324

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:2312

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
1⤵
PID:372

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
1⤵
PID:1036

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
1⤵
PID:2728

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:912

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
1⤵
PID:2208

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:1552

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:3052

C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
1⤵
PID:3016

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:1940

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:2500
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
  2⤵
  PID:2680
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:2928
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
  2⤵
  PID:2344
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:676
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:2812
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
  2⤵
  PID:2760
- - C:\PerfLogs\Admin\backup.exe
    C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
    3⤵
    PID:1524

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:1096
- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
  2⤵
  PID:2240

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:1588

C:\Program Files\Common Files\Microsoft Shared\Stationery\data.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\data.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:828

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:848
- C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
  2⤵
  PID:2436
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:476
- C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
  2⤵
  PID:3004
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:440
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:2548
- C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
  2⤵
  PID:1908

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:984
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:1724
- C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
  2⤵
  PID:2744
- C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
  2⤵
  PID:2796
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:1564
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:1596
- C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
  2⤵
  PID:2092

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:2188

C:\Program Files\Common Files\Microsoft Shared\VGX\data.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\data.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:2856

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:2768
- C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
  2⤵
  PID:3028

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:2696

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:588

C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
1⤵
PID:1776

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:2252
- C:\Program Files\Common Files\System\ado\backup.exe
  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
  2⤵
  PID:1928
- - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
    3⤵
    PID:2600
- - C:\Program Files\Common Files\System\ado\en-US\backup.exe
    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
    3⤵
    PID:2064
- - C:\Program Files\Common Files\System\ado\es-ES\backup.exe
    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
    3⤵
    PID:2156
- - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
    3⤵
    PID:1428
- - C:\Program Files\Common Files\System\ado\it-IT\backup.exe
    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
    3⤵
    PID:1684
- - C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
    3⤵
    PID:1012
- C:\Program Files\Common Files\System\de-DE\backup.exe
  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
  2⤵
  PID:1628
- C:\Program Files\Common Files\System\en-US\System Restore.exe
  "C:\Program Files\Common Files\System\en-US\System Restore.exe" C:\Program Files\Common Files\System\en-US\
  2⤵
  PID:3000
- C:\Program Files\Common Files\System\es-ES\backup.exe
  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
  2⤵
  PID:1480
- C:\Program Files\Common Files\System\msadc\backup.exe
  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
  2⤵
  PID:2032
- - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
    "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
    3⤵
    PID:2096
- - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
    3⤵
    PID:1332
- - C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
    3⤵
    PID:808
- - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
    3⤵
    PID:1724
- - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
    "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
    3⤵
    PID:928
- - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
    3⤵
    PID:372
- C:\Program Files\Common Files\System\Ole DB\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
  2⤵
  PID:2836
- - C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
    3⤵
    PID:752
- - C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
    3⤵
    PID:2608
- - C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
    3⤵
    PID:2800
- - C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
    3⤵
    PID:2536
- - C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
    3⤵
    PID:2720
- - C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
    3⤵
    PID:2100
- C:\Program Files\Common Files\System\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
  2⤵
  PID:2992
- C:\Program Files\Common Files\System\it-IT\System Restore.exe
  "C:\Program Files\Common Files\System\it-IT\System Restore.exe" C:\Program Files\Common Files\System\it-IT\
  2⤵
  PID:2860
- C:\Program Files\Common Files\System\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
  2⤵
  PID:1752

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:2256

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:1992
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:3016
- - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
    3⤵
    PID:3012
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
      4⤵
      PID:1248
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        5⤵
        
        PID:2828
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        5⤵
        
        PID:2268
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        5⤵
        
        PID:2988
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        5⤵
        
        PID:2880
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
        6⤵
        
        PID:1860
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        5⤵
        
        PID:1660
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        5⤵
        
        PID:2776
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
        6⤵
        
        PID:268
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        5⤵
        
        PID:2064
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        5⤵
        
        PID:1280
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
        5⤵
        
        PID:1760
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
      4⤵
      PID:440
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
      4⤵
      PID:2348
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2892
- - C:\Program Files (x86)\Common Files\Adobe\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
    3⤵
    PID:2548
  - - C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe
      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
      4⤵
      PID:3064
- - C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
    3⤵
    PID:2320
  - - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
      4⤵
      PID:3056
- - C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
    "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
    3⤵
    PID:3032
- - C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
    3⤵
    PID:1288
- - C:\Program Files (x86)\Common Files\Services\backup.exe
    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
    3⤵
    PID:1848
- - C:\Program Files (x86)\Common Files\SpeechEngines\data.exe
    "C:\Program Files (x86)\Common Files\SpeechEngines\data.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
    3⤵
    PID:1576
- - C:\Program Files (x86)\Common Files\System\backup.exe
    "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
    3⤵
    PID:2860
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:1036
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft Office\backup.exe
  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft.NET\backup.exe
  "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
  2⤵
  PID:2684
- C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  PID:1996

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2216
- C:\Program Files\DVD Maker\de-DE\backup.exe
  "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
  2⤵
  PID:1376
- - C:\Program Files\Common Files\Microsoft Shared\ink\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
    3⤵
    PID:2104
- - C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
    3⤵
    PID:2312
- C:\Program Files\DVD Maker\en-US\backup.exe
  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
  2⤵
  PID:2492
- C:\Program Files\DVD Maker\es-ES\backup.exe
  "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
  2⤵
  PID:1120
- C:\Program Files\DVD Maker\fr-FR\backup.exe
  "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
  2⤵
  PID:780
- C:\Program Files\DVD Maker\it-IT\backup.exe
  "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
  2⤵
  PID:2232
- C:\Program Files\DVD Maker\ja-JP\backup.exe
  "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
  2⤵
  PID:1424
- C:\Program Files\DVD Maker\Shared\backup.exe
  "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
  2⤵
  PID:3004
- - C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
    3⤵
    PID:2924

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:2504

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:1232

C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
1⤵
PID:2320

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:2376

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:2360

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
1⤵
PID:2096

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
1⤵
PID:2032

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:632

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
1⤵
PID:392

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:796

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1016
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:2012
- - C:\Users\Admin\Contacts\data.exe
    C:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\
    3⤵
    PID:2764
- - C:\Users\Admin\Desktop\backup.exe
    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
    3⤵
    PID:2840
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:1232

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2992

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
1⤵
PID:1560

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:3020

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:2656

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
1⤵
PID:2348

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
1⤵
PID:912

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:1028

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
1⤵
PID:948

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
1⤵
PID:1332

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
1⤵
PID:2360

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:2896

C:\Program Files\Common Files\Microsoft Shared\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
1⤵
PID:1376

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:2844

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:696
- C:\Windows\addins\backup.exe
  C:\Windows\addins\backup.exe C:\Windows\addins\
  2⤵
  PID:2424
- C:\Windows\AppCompat\backup.exe
  C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
  2⤵
  PID:2708
- C:\Windows\AppPatch\backup.exe
  C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
  2⤵
  PID:552
- C:\Windows\assembly\backup.exe
  C:\Windows\assembly\backup.exe C:\Windows\assembly\
  2⤵
  PID:1732
- C:\Windows\Branding\backup.exe
  C:\Windows\Branding\backup.exe C:\Windows\Branding\
  2⤵
  PID:2608
- C:\Windows\CSC\backup.exe
  C:\Windows\CSC\backup.exe C:\Windows\CSC\
  2⤵
  PID:2276

C:\Program Files\7-Zip\Lang\backup.exe
"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
1⤵
PID:1472

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:2456

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:2204

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:1956
- C:\Program Files\Java\backup.exe
  "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
  2⤵
  PID:2796
- C:\Program Files\Microsoft Games\backup.exe
  "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
  2⤵
  PID:2164
- C:\Program Files\Microsoft Office\backup.exe
  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
  2⤵
  PID:872
- C:\Program Files\Mozilla Firefox\backup.exe
  "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
  2⤵
  PID:2432
- C:\Program Files\MSBuild\backup.exe
  "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
  2⤵
  PID:1364
- C:\Program Files\Reference Assemblies\backup.exe
  "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
  2⤵
  PID:2996
- C:\Program Files\VideoLAN\backup.exe
  "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
  2⤵
  PID:2728
- C:\Program Files\Windows Defender\backup.exe
  "C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
  2⤵
  PID:2804

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:2760

C:\backup.exe
\backup.exe \
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
C:\PerfLogs\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
C:\PerfLogs\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
122KB

MD5
59357c85bc79060784535c07eb48cab6

SHA1
34176a07e3890c025c3e94b387e90518c179e0e4

SHA256
c6f01708cdd93e6409579613d701433a6b9881b396a529109a5c6ac5d46519ca

SHA512
d30127078991a7c145ac7043f4848f37e2992641954b19664d2e9d9ed6203e6e7de79296a0295ae410ab0807a69413c83c93ff61eed5923b878bd201758abd0d

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
122KB

MD5
6a5837ef22957c0db6e0e80ae7d48cdf

SHA1
c1e4ff945fb25a810c8e979e1d3ae9472c527fc3

SHA256
7843f12840adcab3496350eb34aaeff1f9df74421d16decd26e5a9943dc8f691

SHA512
b0585c630a2cd22ec59dd04d63db029b79a3488adf348bac9b12e295b2e22538a833f300920512c913469a3e106fb610a6d20df6104f0c06ec17edd753c0559e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
122KB

MD5
6a5837ef22957c0db6e0e80ae7d48cdf

SHA1
c1e4ff945fb25a810c8e979e1d3ae9472c527fc3

SHA256
7843f12840adcab3496350eb34aaeff1f9df74421d16decd26e5a9943dc8f691

SHA512
b0585c630a2cd22ec59dd04d63db029b79a3488adf348bac9b12e295b2e22538a833f300920512c913469a3e106fb610a6d20df6104f0c06ec17edd753c0559e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\data.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\data.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
C:\Program Files\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
C:\Program Files\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009592410\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009592410\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009592410\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
41KB

MD5
4809a8b372f46fe659a67c5ee5a4a0dd

SHA1
67a443cb1ac8d7743f5e7391198fa9161978d8f2

SHA256
61b0d5e729777a23ae69c137e5a30ee70c5915015e35c8e5e6df5d208e5f2cf9

SHA512
882f6474280ef8757c086d78c0e8879b653a491fc3b9baa9840181ea411a01c1ba313f07956ba9aa458e37d6d7bb2e66f0da06bef55a7d2a05c0b36ed3fd3f67

Download Submit
C:\backup.exe

Filesize
122KB

MD5
0a724b42860af450161b7f75a707648a

SHA1
aec713ed1abad80b2a9641249d4bcbc691d2ecc2

SHA256
db887aa1154d333ecc08c9f44ab7829309b658aa258d074bbc9db5b224bbfd48

SHA512
0f80fd365431c46c2c1e91e6df70c661fa4ea7eb5784b24037d4a2b6d3a72a2ac1381cca7908962ecd2e11069646baf80d80286d482d735ed8f85dcc93dfb044

Download Submit
C:\backup.exe

Filesize
122KB

MD5
0a724b42860af450161b7f75a707648a

SHA1
aec713ed1abad80b2a9641249d4bcbc691d2ecc2

SHA256
db887aa1154d333ecc08c9f44ab7829309b658aa258d074bbc9db5b224bbfd48

SHA512
0f80fd365431c46c2c1e91e6df70c661fa4ea7eb5784b24037d4a2b6d3a72a2ac1381cca7908962ecd2e11069646baf80d80286d482d735ed8f85dcc93dfb044

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
\PerfLogs\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
\PerfLogs\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
122KB

MD5
59357c85bc79060784535c07eb48cab6

SHA1
34176a07e3890c025c3e94b387e90518c179e0e4

SHA256
c6f01708cdd93e6409579613d701433a6b9881b396a529109a5c6ac5d46519ca

SHA512
d30127078991a7c145ac7043f4848f37e2992641954b19664d2e9d9ed6203e6e7de79296a0295ae410ab0807a69413c83c93ff61eed5923b878bd201758abd0d

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
122KB

MD5
59357c85bc79060784535c07eb48cab6

SHA1
34176a07e3890c025c3e94b387e90518c179e0e4

SHA256
c6f01708cdd93e6409579613d701433a6b9881b396a529109a5c6ac5d46519ca

SHA512
d30127078991a7c145ac7043f4848f37e2992641954b19664d2e9d9ed6203e6e7de79296a0295ae410ab0807a69413c83c93ff61eed5923b878bd201758abd0d

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
122KB

MD5
6a5837ef22957c0db6e0e80ae7d48cdf

SHA1
c1e4ff945fb25a810c8e979e1d3ae9472c527fc3

SHA256
7843f12840adcab3496350eb34aaeff1f9df74421d16decd26e5a9943dc8f691

SHA512
b0585c630a2cd22ec59dd04d63db029b79a3488adf348bac9b12e295b2e22538a833f300920512c913469a3e106fb610a6d20df6104f0c06ec17edd753c0559e

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
122KB

MD5
6a5837ef22957c0db6e0e80ae7d48cdf

SHA1
c1e4ff945fb25a810c8e979e1d3ae9472c527fc3

SHA256
7843f12840adcab3496350eb34aaeff1f9df74421d16decd26e5a9943dc8f691

SHA512
b0585c630a2cd22ec59dd04d63db029b79a3488adf348bac9b12e295b2e22538a833f300920512c913469a3e106fb610a6d20df6104f0c06ec17edd753c0559e

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

Filesize
122KB

MD5
f79f67a62ee05ea27712b6182a3e3501

SHA1
f265fff43560f42c5788991079cd92c5b1113dda

SHA256
6caef6d57007fc46d7ffecdac3ee897c2cb0f4b301ef8134732355a68ca81078

SHA512
75ac931cb8d8b20d26fe3781af0d2bb0d36c75cf596c0067dccb0f8d43abb92152747ea8386bc60649ebe168478fc603bbcb07cf592deab4e4beb337d576fded

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\data.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\data.exe

Filesize
122KB

MD5
5c4cd5367596c9e0302da07c41d5e2a4

SHA1
e05903c6c61a6aa5c6e68b3bf00ead448e70ba37

SHA256
ee6b2b17862e793ea723c3a53ec268fd3726e3cd9b9148ff43f50a6f09a3f7d2

SHA512
994992b8fe8ced1570b7f14f7ce5947ead887800acbf63624fcc4cd788028eab899c7abdc6a93bbc0b254f5e4e245dfdafbc3816b99a8f62abf4587b6dc42dce

Download Submit
\Program Files\Common Files\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
\Program Files\Common Files\backup.exe

Filesize
122KB

MD5
41bc6b3d4a78f7e392d2e5a3e3e3b7ea

SHA1
48800aa65be6643132079db7a1dba9bcbb854043

SHA256
7cc30bed27ed5aca6ab3db0d13bded719ad5ed07cc38dd70eca86cd14b84e155

SHA512
98ea4b4892e5a2c8d1adfba150e478d0f51b9f0a724d034a3e4fcb9a51d618ed216cc6551d2d83aac1cf77c7bf922deaf9cff4924cd7b5eadc4644dee3a0539f

Download Submit
\Program Files\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
\Program Files\backup.exe

Filesize
122KB

MD5
d927db8b0c690c46ba20d9dcfee0cbda

SHA1
3e12799b821234da58ffcdc8f42bcf3cf65686d5

SHA256
20607d3eadef0307c03be5f40fbba85b5ff464530163598b674ee9049ad6787c

SHA512
18e7d3e3c7140401c567689e4bf8ed089369b1ee5f0e773f889b5ce5314c931494bce36d10e3090584d14b6837fb157e58541eb9b2e2d04d30742749b8c5a872

Download Submit
\Users\Admin\AppData\Local\Temp\1009592410\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\1009592410\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
122KB

MD5
de568cb97958d22fff4d4c45a5f01c2e

SHA1
fa709293d92269d0e200a82198e3f4aaf3c62f38

SHA256
b9e11035cf639fa8e0d7624b41849544824095f5086d5d28b97981ffb964e711

SHA512
3c855b967209da9e84f68c3e16a8fba8d293af56379c5ca53ff1e4a04e0244c383354d6de9c9dfa52fc07a95d701c83d7a2947cd084e110bc64a0565bffb13c7

Download Submit
memory/392-450-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/632-468-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/676-698-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/768-212-0x0000000000260000-0x0000000000284000-memory.dmp

Filesize
144KB

Download
memory/768-149-0x0000000000260000-0x0000000000284000-memory.dmp

Filesize
144KB

Download
memory/768-123-0x0000000000260000-0x0000000000284000-memory.dmp

Filesize
144KB

Download
memory/768-173-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/768-110-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/848-485-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/912-574-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/912-292-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/948-274-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1036-556-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1196-28-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1232-637-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1276-432-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1276-430-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1288-426-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1288-433-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1288-428-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/1288-407-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/1324-477-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1332-266-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1364-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1364-59-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1376-213-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/1376-279-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/1376-263-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1472-186-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1524-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1552-604-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1560-335-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1720-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1720-109-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1720-163-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/1720-83-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1948-419-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1956-237-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download
memory/1956-215-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2032-520-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2084-376-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2104-660-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2104-356-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-424-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-535-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-525-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-562-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-498-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-249-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-260-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-296-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2104-515-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-516-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-527-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-306-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-315-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-316-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-425-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-349-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-298-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-390-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-537-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-464-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-446-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-455-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-473-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-597-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-589-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-587-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2104-545-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2112-394-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2208-583-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2312-510-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2312-218-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2344-689-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2348-301-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2360-253-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2368-148-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2368-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2368-24-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2368-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2368-47-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2368-161-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2368-36-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2368-90-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2368-12-0x0000000000300000-0x0000000000324000-memory.dmp

Filesize
144KB

Download
memory/2368-706-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2376-592-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2456-175-0x00000000002A0000-0x00000000002C4000-memory.dmp

Filesize
144KB

Download
memory/2456-180-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2496-381-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2496-385-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2504-645-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2532-86-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2616-74-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2640-368-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2656-310-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2680-671-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2700-122-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2708-401-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2760-139-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2760-717-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2760-135-0x0000000000390000-0x00000000003B4000-memory.dmp

Filesize
144KB

Download
memory/2804-360-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2812-709-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2844-256-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2844-200-0x0000000000360000-0x0000000000384000-memory.dmp

Filesize
144KB

Download
memory/2844-262-0x0000000000360000-0x0000000000384000-memory.dmp

Filesize
144KB

Download
memory/2844-199-0x0000000000360000-0x0000000000384000-memory.dmp

Filesize
144KB

Download
memory/2872-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2896-241-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2928-680-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2956-411-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3020-320-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3052-343-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads