Overview

overview

10

Static

static

10

NEAS.94c0e...70.exe

windows7-x64

10

NEAS.94c0e...70.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    13s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2023 03:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.94c0e477890989071e29a34b4d7df670.exe

  • Size

    122KB

  • MD5

    94c0e477890989071e29a34b4d7df670

  • SHA1

    4a4a74cc0688fe8ff5a37597f8d1dfa37e590d33

  • SHA256

    fb7342e870aafb834eb163749ad8b0768452b34620a4d7217760a0f98824c7e9

  • SHA512

    96af4d441f149bac28f56d4ee02774113bcc32bb450df8bbf0f90657e0d7799d0a547a5fd55d09a51d5fe60426c8e0371c5fe0a8c2cec64957bfea995f74ec91

  • SSDEEP

    1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4L:6u8ANCUdgfmD7zey0KUj6TjR9i4L

Score
10/10
dropperevasionpersistencetrojan

Malware Config

Signatures

  • Malware Backdoor - Berbew 64 IoCs

    Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

    persistencedroppertrojan
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.94c0e477890989071e29a34b4d7df670.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.94c0e477890989071e29a34b4d7df670.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2732
    • C:\Users\Admin\AppData\Local\Temp\2277813038\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2277813038\backup.exe C:\Users\Admin\AppData\Local\Temp\2277813038\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2672
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2848
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1492
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1036
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2676
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1648
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:664
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1744
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2084
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1764
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:836
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1128
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:996
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1196
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2200
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2256
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1420
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1728
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2076
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2704
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2756
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2864
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2712
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2484
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2504
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3008
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2856
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:528
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1380
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1184
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2868
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2548
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1132
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2576
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1656
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1692
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2268
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1028
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1748
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2136
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:700
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1812
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:836
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2308
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:284
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2964
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2932
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:884
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2904
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1628
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2056
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1212
                • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2596
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2716
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1220
              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System policy modification
                PID:2908
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:2708
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:2552
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:2000
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:2028
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                  8⤵
                  • System policy modification
                  PID:2664
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:2776
              • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\update.exe
                "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\update.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Drops file in Program Files directory
                • System policy modification
                PID:1104
                • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                  8⤵
                    PID:1608
                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:752
                • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:1492
                • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                  7⤵
                  • Drops file in Program Files directory
                  • System policy modification
                  PID:436
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1132
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1652
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1772
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                    8⤵
                      PID:1740
                    • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:2284
                    • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:2348
                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Drops file in Program Files directory
                    PID:1792
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:840
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:1812
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                      8⤵
                      • System policy modification
                      PID:2132
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
                      8⤵
                      • System policy modification
                      PID:2680
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:996
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:2288
                  • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                    7⤵
                      PID:1876
                    • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                      7⤵
                        PID:1420
                      • C:\Program Files\Common Files\Microsoft Shared\VSTO\System Restore.exe
                        "C:\Program Files\Common Files\Microsoft Shared\VSTO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Drops file in Program Files directory
                        • System policy modification
                        PID:856
                        • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
                          8⤵
                            PID:2596
                            • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
                              9⤵
                                PID:536
                        • C:\Program Files\Common Files\Services\backup.exe
                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                          6⤵
                            PID:2472
                          • C:\Program Files\Common Files\SpeechEngines\backup.exe
                            "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                            6⤵
                              PID:2908
                              • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                7⤵
                                  PID:2436
                              • C:\Program Files\Common Files\System\backup.exe
                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                6⤵
                                  PID:552
                              • C:\Program Files\DVD Maker\backup.exe
                                "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                5⤵
                                  PID:2488
                                  • C:\Program Files\DVD Maker\de-DE\backup.exe
                                    "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                    6⤵
                                      PID:2836
                                    • C:\Program Files\DVD Maker\en-US\backup.exe
                                      "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                      6⤵
                                        PID:2172
                                      • C:\Program Files\DVD Maker\es-ES\data.exe
                                        "C:\Program Files\DVD Maker\es-ES\data.exe" C:\Program Files\DVD Maker\es-ES\
                                        6⤵
                                          PID:1652
                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                          6⤵
                                            PID:2424
                                          • C:\Program Files\DVD Maker\it-IT\backup.exe
                                            "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                            6⤵
                                              PID:2724
                                            • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                              "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                              6⤵
                                                PID:2036
                                              • C:\Program Files\DVD Maker\Shared\backup.exe
                                                "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                6⤵
                                                  PID:1504
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                    7⤵
                                                      PID:1564
                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                        8⤵
                                                          PID:664
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                          8⤵
                                                            PID:2596
                                                    • C:\Program Files\Google\backup.exe
                                                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                      5⤵
                                                        PID:2788
                                                      • C:\Program Files\Internet Explorer\data.exe
                                                        "C:\Program Files\Internet Explorer\data.exe" C:\Program Files\Internet Explorer\
                                                        5⤵
                                                          PID:1828
                                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                            6⤵
                                                              PID:1420
                                                            • C:\Program Files\Internet Explorer\en-US\update.exe
                                                              "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
                                                              6⤵
                                                                PID:2840
                                                              • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                6⤵
                                                                  PID:1604
                                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                  6⤵
                                                                    PID:940
                                                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                    6⤵
                                                                      PID:2528
                                                                    • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                      6⤵
                                                                        PID:1656
                                                                      • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                        6⤵
                                                                          PID:1408
                                                                        • C:\Program Files\Internet Explorer\SIGNUP\data.exe
                                                                          "C:\Program Files\Internet Explorer\SIGNUP\data.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                          6⤵
                                                                            PID:2556
                                                                        • C:\Program Files\Java\backup.exe
                                                                          "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                          5⤵
                                                                            PID:2688
                                                                            • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                                              "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                                              6⤵
                                                                                PID:2152
                                                                              • C:\Program Files\Java\jre7\System Restore.exe
                                                                                "C:\Program Files\Java\jre7\System Restore.exe" C:\Program Files\Java\jre7\
                                                                                6⤵
                                                                                  PID:2276
                                                                                  • C:\Program Files\Java\jre7\bin\backup.exe
                                                                                    "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
                                                                                    7⤵
                                                                                      PID:2604
                                                                                    • C:\Program Files\Java\jre7\lib\backup.exe
                                                                                      "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
                                                                                      7⤵
                                                                                        PID:2304
                                                                                  • C:\Program Files\Microsoft Games\backup.exe
                                                                                    "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                    5⤵
                                                                                      PID:268
                                                                                      • C:\Program Files\Microsoft Games\Chess\backup.exe
                                                                                        "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
                                                                                        6⤵
                                                                                          PID:1692
                                                                                        • C:\Program Files\Microsoft Games\FreeCell\backup.exe
                                                                                          "C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
                                                                                          6⤵
                                                                                            PID:1720
                                                                                          • C:\Program Files\Microsoft Games\Hearts\backup.exe
                                                                                            "C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
                                                                                            6⤵
                                                                                              PID:1508
                                                                                              • C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
                                                                                                "C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
                                                                                                7⤵
                                                                                                  PID:2128
                                                                                              • C:\Program Files\Microsoft Games\Mahjong\backup.exe
                                                                                                "C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
                                                                                                6⤵
                                                                                                  PID:1936
                                                                                                • C:\Program Files\Microsoft Games\Minesweeper\backup.exe
                                                                                                  "C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
                                                                                                  6⤵
                                                                                                    PID:768
                                                                                                  • C:\Program Files\Microsoft Games\More Games\backup.exe
                                                                                                    "C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\
                                                                                                    6⤵
                                                                                                      PID:932
                                                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                    5⤵
                                                                                                      PID:2096
                                                                                                      • C:\Program Files\Microsoft Office\Office14\backup.exe
                                                                                                        "C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
                                                                                                        6⤵
                                                                                                          PID:2664
                                                                                                          • C:\Program Files\Microsoft Office\Office14\1033\backup.exe
                                                                                                            "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
                                                                                                            7⤵
                                                                                                              PID:2608
                                                                                                        • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                          5⤵
                                                                                                            PID:2696
                                                                                                            • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                              6⤵
                                                                                                                PID:2564
                                                                                                              • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                6⤵
                                                                                                                  PID:2824
                                                                                                              • C:\Program Files\MSBuild\backup.exe
                                                                                                                "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                                                5⤵
                                                                                                                  PID:2780
                                                                                                                • C:\Program Files\Reference Assemblies\backup.exe
                                                                                                                  "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                                                                  5⤵
                                                                                                                    PID:3024
                                                                                                                  • C:\Program Files\VideoLAN\update.exe
                                                                                                                    "C:\Program Files\VideoLAN\update.exe" C:\Program Files\VideoLAN\
                                                                                                                    5⤵
                                                                                                                      PID:3000
                                                                                                                    • C:\Program Files\Windows Defender\backup.exe
                                                                                                                      "C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
                                                                                                                      5⤵
                                                                                                                        PID:1768
                                                                                                                    • C:\Program Files (x86)\backup.exe
                                                                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                      4⤵
                                                                                                                      • System policy modification
                                                                                                                      PID:1620
                                                                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                        5⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        PID:2056
                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                                                          6⤵
                                                                                                                            PID:2668
                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                                              7⤵
                                                                                                                                PID:2084
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                                                7⤵
                                                                                                                                  PID:3004
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                                                    8⤵
                                                                                                                                      PID:1716
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                                                      8⤵
                                                                                                                                        PID:1784
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                                                        8⤵
                                                                                                                                          PID:2896
                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                                                          8⤵
                                                                                                                                            PID:1564
                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                                                              9⤵
                                                                                                                                                PID:1128
                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                                                              8⤵
                                                                                                                                                PID:1240
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                                                                8⤵
                                                                                                                                                  PID:2228
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                                                                    9⤵
                                                                                                                                                      PID:1792
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                                                                    8⤵
                                                                                                                                                      PID:568
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                                                                      8⤵
                                                                                                                                                        PID:2948
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1184
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
                                                                                                                                                            9⤵
                                                                                                                                                              PID:856
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                                                                            8⤵
                                                                                                                                                              PID:1740
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                                                                              8⤵
                                                                                                                                                                PID:2580
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                                                              7⤵
                                                                                                                                                                PID:1632
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:1028
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:2592
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:896
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:2088
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:1256
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:1688
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:1820
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1356
                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:2436
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:2392
                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Help\update.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Help\update.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:1160
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:2596
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1912
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:2484
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1168
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:1100
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:988
                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\microsoft shared\DW\data.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\microsoft shared\DW\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:2340
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:2568
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:2144
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:2004
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:1068
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:2692
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                            • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:1200
                                                                                                                                                                                                                • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:2820
                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:1956
                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:1940
                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Update\Offline\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:584
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:576
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:1112
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:840
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft.NET\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:528
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:1500
                                                                                                                                                                                                                                                • C:\Users\backup.exe
                                                                                                                                                                                                                                                  C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1492
                                                                                                                                                                                                                                                    • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:1816
                                                                                                                                                                                                                                                        • C:\Users\Admin\Contacts\System Restore.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:844
                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:1896
                                                                                                                                                                                                                                                                • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:2084
                                                                                                                                                                                                                                                                • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                  C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:2384
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:2612
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:2708
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:2532

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • C:\PerfLogs\Admin\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              0852f8dc0b5b9eb9a184c5f47491b225

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f368df53421da9ba194e5b17702aaa3aac3bf722

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              c7f9c37fea0f8256953e99eb9f98a96c90f5277348664c710fe3edee08062bb2

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              e5e8ff176f01d4f98089b2a32c252cb1028d3f0fc10913a32779cdc2cf37b71950cc0b60c631f6cf22aef44fc142d5413ad457d3e129b2c1cc63ad01b027bb24

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              84ddd3d98db2a2e17d94b139536fc21d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              dce1e6e720db47c378bb0028e872732c2812a6fb

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              13efb72b34c4b0a5fab9fdf976d8237b2844e6927f128785f5738a8a28244192

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0c1a865c48d35a7ff65f298148791de1ab33ae1f0cf307f3c05d789520d8ee5f5d57331b85528055ac32f99f37a037aad09a4b77f07e4d5d5cc3f0c6adb818fb

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              84ddd3d98db2a2e17d94b139536fc21d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              dce1e6e720db47c378bb0028e872732c2812a6fb

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              13efb72b34c4b0a5fab9fdf976d8237b2844e6927f128785f5738a8a28244192

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0c1a865c48d35a7ff65f298148791de1ab33ae1f0cf307f3c05d789520d8ee5f5d57331b85528055ac32f99f37a037aad09a4b77f07e4d5d5cc3f0c6adb818fb

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              7322fea3ec4ca143a84069706c121fea

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              e13b7d1391ce68b196f4646fbb7766612f48fade

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              f9f220552c80025bf4345bc63011240f3a89986af03333a386c3742989dc2370

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              2010be2d9294e5e081d91b5dba9ac247451b6255465ad99dbde7cf161055a2275287e4a9d40d8938824b52d5063c9ad4142d32717126295036da0c4a44d688fa

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Program Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              7322fea3ec4ca143a84069706c121fea

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              e13b7d1391ce68b196f4646fbb7766612f48fade

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              f9f220552c80025bf4345bc63011240f3a89986af03333a386c3742989dc2370

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              2010be2d9294e5e081d91b5dba9ac247451b6255465ad99dbde7cf161055a2275287e4a9d40d8938824b52d5063c9ad4142d32717126295036da0c4a44d688fa

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2277813038\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2277813038\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2277813038\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              cb4c071f28e5b066f35fabf6c0dc2d16

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f70237aa182eb2f92c5b2e297ae25f534dff761e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4b70f6852929c1612ea127e92be2a51826ddc1a26670b5feadca344a4a2ef773

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d61fbd45ad8a55b36b47763c8c7f9ee5d8f4eed0f6303c444e41445cbd9446fe357c79aaab0edfd19a13c64565cab73d66b8b4ccf25a278a11c10759ce2c1737

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              cb4c071f28e5b066f35fabf6c0dc2d16

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f70237aa182eb2f92c5b2e297ae25f534dff761e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4b70f6852929c1612ea127e92be2a51826ddc1a26670b5feadca344a4a2ef773

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d61fbd45ad8a55b36b47763c8c7f9ee5d8f4eed0f6303c444e41445cbd9446fe357c79aaab0edfd19a13c64565cab73d66b8b4ccf25a278a11c10759ce2c1737

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.zip
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              517977f8fa03abc6ba8e54945d23e192

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              ec89e98bfba873820d52a0566e305d22bf720e87

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              6fe8bb11a680a04b5ed5c50b1078242eed4becbad49a02ee23f3b7b16c6e6452

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              b004457a6614d675945e950c0206be8413ef02cb7cc55d6c86a7afa1f9cf718f4de7d32767fd9c8e1d0294202490519a745a2761d1e768ab1b43c9149bdacfdd

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.zip
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              22B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              76cdb2bad9582d23c1f6f4d868218d6c

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              1ed107d63932c8343c9e70e93c7d9c17

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              00bb642cda7566051e4baeb0bc858cc289f7d822

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              2ebb0d776adfea6e73be32547de69ada84198a215788b842225324d3bc9af5a3

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              a60d3c4e56f3a5f756d8a6dc606dd416b4fe4dd1f9635d0f225bc556554364f7c8d6ff18be8976bff277be471d763eba68520f976a61dc1dad78fee7b78f0989

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              1ed107d63932c8343c9e70e93c7d9c17

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              00bb642cda7566051e4baeb0bc858cc289f7d822

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              2ebb0d776adfea6e73be32547de69ada84198a215788b842225324d3bc9af5a3

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              a60d3c4e56f3a5f756d8a6dc606dd416b4fe4dd1f9635d0f225bc556554364f7c8d6ff18be8976bff277be471d763eba68520f976a61dc1dad78fee7b78f0989

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              0852f8dc0b5b9eb9a184c5f47491b225

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f368df53421da9ba194e5b17702aaa3aac3bf722

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              c7f9c37fea0f8256953e99eb9f98a96c90f5277348664c710fe3edee08062bb2

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              e5e8ff176f01d4f98089b2a32c252cb1028d3f0fc10913a32779cdc2cf37b71950cc0b60c631f6cf22aef44fc142d5413ad457d3e129b2c1cc63ad01b027bb24

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              0852f8dc0b5b9eb9a184c5f47491b225

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f368df53421da9ba194e5b17702aaa3aac3bf722

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              c7f9c37fea0f8256953e99eb9f98a96c90f5277348664c710fe3edee08062bb2

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              e5e8ff176f01d4f98089b2a32c252cb1028d3f0fc10913a32779cdc2cf37b71950cc0b60c631f6cf22aef44fc142d5413ad457d3e129b2c1cc63ad01b027bb24

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              84ddd3d98db2a2e17d94b139536fc21d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              dce1e6e720db47c378bb0028e872732c2812a6fb

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              13efb72b34c4b0a5fab9fdf976d8237b2844e6927f128785f5738a8a28244192

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0c1a865c48d35a7ff65f298148791de1ab33ae1f0cf307f3c05d789520d8ee5f5d57331b85528055ac32f99f37a037aad09a4b77f07e4d5d5cc3f0c6adb818fb

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              84ddd3d98db2a2e17d94b139536fc21d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              dce1e6e720db47c378bb0028e872732c2812a6fb

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              13efb72b34c4b0a5fab9fdf976d8237b2844e6927f128785f5738a8a28244192

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              0c1a865c48d35a7ff65f298148791de1ab33ae1f0cf307f3c05d789520d8ee5f5d57331b85528055ac32f99f37a037aad09a4b77f07e4d5d5cc3f0c6adb818fb

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              ba32e73f7cf42515c56c5484bbfe70fa

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              5409c90b9aa6afa05a01e6a84981c059ac99bf72

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              758010b8ffdeb9889cc8b4484cef8746ad421c3a631c92303c1a678265b0cb33

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              edcd7741acaaf9f8533864be768af6030d3087e905d042803010adb85db86b8e1136efa59af2dcaa6a67af0af4d02ff005afd5f8fc509fafb41b9acb348df5d4

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              4de9adc52f5d14d1b2c3dc88bae14a43

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              301583a1aa2ac5a576a1c22a5c6027214341925b

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              8c9c1962f918a56f9253701126b85824576b6747abb401e07c9abb2bc6cca366

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              3624af16c777ccbf13d625a63f20d432484fdd0ff81a808abde54d2215bd2fc6b99d21c76d4f9efdf7adc7dd0123f973648dde76689f089bd6e68c7b00c7b996

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              fd5765a47c333418c47761176033e211

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              d2b1393456098c69e517c60e7382b7c518b80eca

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4da1e51e5ba9c039c0c4d28c110eace96bda74488f7ee4d502d6cf7932505d1a

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d3cec689ed4434da07f0bd9c408f548f3a6bee13a99432b30691ee70871b9ffb0985a765063626ef0039d7206adc49450b7c53b4306698a623efcb7f0b1eda6e

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              e23f8209fb98046f4b41d889fce00c8d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6fc0cc662b2d96bd1dc540c0a1e7ee53c71db7e1

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              17a1dd4b15a3daf2f067cfd2db282ee8fe628ad9e59dddb51bab8a60e3e8f608

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              45fdde5eaab12e15c5fff52ba7ab68f453df0fbe8660cc11802f2edb41e38c648e894575e820461e61d8422585e3562cfcc5a3643c6dde3f6fbe174f861e5b40

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              7322fea3ec4ca143a84069706c121fea

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              e13b7d1391ce68b196f4646fbb7766612f48fade

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              f9f220552c80025bf4345bc63011240f3a89986af03333a386c3742989dc2370

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              2010be2d9294e5e081d91b5dba9ac247451b6255465ad99dbde7cf161055a2275287e4a9d40d8938824b52d5063c9ad4142d32717126295036da0c4a44d688fa

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Program Files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              7322fea3ec4ca143a84069706c121fea

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              e13b7d1391ce68b196f4646fbb7766612f48fade

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              f9f220552c80025bf4345bc63011240f3a89986af03333a386c3742989dc2370

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              2010be2d9294e5e081d91b5dba9ac247451b6255465ad99dbde7cf161055a2275287e4a9d40d8938824b52d5063c9ad4142d32717126295036da0c4a44d688fa

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\2277813038\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\2277813038\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              cb4c071f28e5b066f35fabf6c0dc2d16

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f70237aa182eb2f92c5b2e297ae25f534dff761e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4b70f6852929c1612ea127e92be2a51826ddc1a26670b5feadca344a4a2ef773

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d61fbd45ad8a55b36b47763c8c7f9ee5d8f4eed0f6303c444e41445cbd9446fe357c79aaab0edfd19a13c64565cab73d66b8b4ccf25a278a11c10759ce2c1737

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              cb4c071f28e5b066f35fabf6c0dc2d16

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f70237aa182eb2f92c5b2e297ae25f534dff761e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4b70f6852929c1612ea127e92be2a51826ddc1a26670b5feadca344a4a2ef773

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d61fbd45ad8a55b36b47763c8c7f9ee5d8f4eed0f6303c444e41445cbd9446fe357c79aaab0edfd19a13c64565cab73d66b8b4ccf25a278a11c10759ce2c1737

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              af6ff1e99750f31ce9365778c52b81b6

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              c3144ba5d88dc5a3744f16d403ca61d355314c25

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              99b2cfdc2c9b2781ba4c463fbf93de833c2f19bc9776aedac6a76ac21f15a970

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              bf983c5495adf2824dd5f20edfe185e96dc35a2395214b02b0d23d67878dc2bf1db833ae2b72e4946bd055ed7dc95d6497910e16caa61a75672719b17db5a54a

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              cb4c071f28e5b066f35fabf6c0dc2d16

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f70237aa182eb2f92c5b2e297ae25f534dff761e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4b70f6852929c1612ea127e92be2a51826ddc1a26670b5feadca344a4a2ef773

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d61fbd45ad8a55b36b47763c8c7f9ee5d8f4eed0f6303c444e41445cbd9446fe357c79aaab0edfd19a13c64565cab73d66b8b4ccf25a278a11c10759ce2c1737

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              122KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              cb4c071f28e5b066f35fabf6c0dc2d16

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              f70237aa182eb2f92c5b2e297ae25f534dff761e

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              4b70f6852929c1612ea127e92be2a51826ddc1a26670b5feadca344a4a2ef773

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              d61fbd45ad8a55b36b47763c8c7f9ee5d8f4eed0f6303c444e41445cbd9446fe357c79aaab0edfd19a13c64565cab73d66b8b4ccf25a278a11c10759ce2c1737

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • memory/284-583-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/528-429-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/664-287-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/664-225-0x00000000003C0000-0x00000000003E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/664-213-0x00000000003C0000-0x00000000003E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/664-310-0x00000000003C0000-0x00000000003E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/664-309-0x00000000003C0000-0x00000000003E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/664-297-0x00000000003C0000-0x00000000003E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/700-549-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/836-565-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/836-255-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/996-282-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1028-522-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1036-177-0x0000000000280000-0x00000000002A4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1036-175-0x0000000000280000-0x00000000002A4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1036-188-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1128-273-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1184-448-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1196-292-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1220-672-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1380-440-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1420-329-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1492-147-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1628-628-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1648-264-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1656-496-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1728-333-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1744-220-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1748-532-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1764-244-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2000-708-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2028-716-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2076-342-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-361-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-406-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-239-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-330-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-348-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-358-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-673-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-312-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-315-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-347-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-359-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-405-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-278-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-354-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-387-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-288-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-388-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-425-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-299-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2084-300-0x0000000000430000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2088-51-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2136-540-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2200-302-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2200-304-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2240-234-0x00000000003A0000-0x00000000003C4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2240-258-0x00000000003A0000-0x00000000003C4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2240-227-0x00000000003A0000-0x00000000003C4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2240-218-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2256-314-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2256-317-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2268-514-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2484-392-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-75-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2504-400-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2532-86-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2548-469-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2552-698-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2576-487-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2596-657-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2612-110-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2636-29-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2672-731-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2672-168-0x00000000003A0000-0x00000000003C4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2672-83-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2672-95-0x00000000003A0000-0x00000000003C4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2672-15-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2676-181-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2704-352-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2708-690-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2708-62-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2712-382-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2712-380-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2716-665-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-37-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-0-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-106-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-133-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-25-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-70-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-190-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-116-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-13-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-136-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-467-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-149-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-161-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-65-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2732-7-0x00000000002C0000-0x00000000002E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-450-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-378-0x0000000000260000-0x0000000000284000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-368-0x0000000000260000-0x0000000000284000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-437-0x0000000000260000-0x0000000000284000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-435-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-426-0x0000000000260000-0x0000000000284000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2756-416-0x0000000000260000-0x0000000000284000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2848-178-0x0000000000340000-0x0000000000364000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2848-173-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2856-424-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2856-418-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2864-372-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2868-460-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2892-135-0x00000000003D0000-0x00000000003F4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2892-145-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2904-619-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3008-411-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                              Download