Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4f80dd422b...18.exe

windows7-x64

10

4f80dd422b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 19:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe

  • Size

    434KB

  • MD5

    e658b241a16eac92f1acc40d6d97e50e

  • SHA1

    24a84e08ae777e19ecabb572ec357a83d7e10524

  • SHA256

    4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018

  • SHA512

    db11cd124f5f15782e7d12fb96e00326dc07513c5a5d80d0906144824eec9b06215fa206cd813acce21a20c0a50c5f11fcbc1e420598f76b99855f37898c850f

  • SSDEEP

    3072:HmVwRKC+mVwRa4zVwGOzVw+63zVwtTbBzVwGOzVwhLmW:HmVnrmVN4zVOzi3zszVOz8LR

Score
10/10
evasionupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • UPX dump on OEP (original entry point) 62 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 56 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe
    "C:\Users\Admin\AppData\Local\Temp\4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\AppData\Local\Temp\1738458047\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1738458047\backup.exe C:\Users\Admin\AppData\Local\Temp\1738458047\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2948
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2320
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2764
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1704
        • C:\Program Files\data.exe
          "C:\Program Files\data.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2312
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:2356
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2388
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:596
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              PID:1856
              • C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2396
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1736
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1364
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1680
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2288
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:916
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:360
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2292
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:984
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1580
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1600
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2952
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:312
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2700
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2596
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2728
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1912
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2172
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2832
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2964
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3012
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1560
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2768
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2836
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:628
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1244
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2808
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1240
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2068
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:336
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:584
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1852
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1328
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2264
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1552
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1828
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:568
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1092
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2260
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:984
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1580
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2944
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2520
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:312
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                    PID:1260
                  • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                    8⤵
                      PID:2780
                    • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                      8⤵
                        PID:2916
                      • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                        8⤵
                          PID:2276
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:2460
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                          8⤵
                            PID:2752
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                            8⤵
                              PID:2868
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                              8⤵
                                PID:1780
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                                8⤵
                                  PID:2216
                                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                                  8⤵
                                    PID:2872
                                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                                    8⤵
                                      PID:2984
                                  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                    7⤵
                                      PID:2680
                                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                                        8⤵
                                          PID:2832
                                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                        7⤵
                                          PID:2056
                                        • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                          7⤵
                                            PID:2920
                                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                            7⤵
                                              PID:2664
                                            • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                              7⤵
                                                PID:2540
                                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                                                  8⤵
                                                    PID:1768
                                                • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                                  "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                                  7⤵
                                                    PID:2776
                                                  • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                                    "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                                    7⤵
                                                      PID:1668
                                                    • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                                      "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                                      7⤵
                                                        PID:1752
                                                    • C:\Program Files\Common Files\Services\backup.exe
                                                      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System policy modification
                                                      PID:2484
                                                    • C:\Program Files\Common Files\SpeechEngines\System Restore.exe
                                                      "C:\Program Files\Common Files\SpeechEngines\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\
                                                      6⤵
                                                        PID:3008
                                                        • C:\Program Files\Common Files\SpeechEngines\Microsoft\data.exe
                                                          "C:\Program Files\Common Files\SpeechEngines\Microsoft\data.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                                          7⤵
                                                            PID:3048
                                                        • C:\Program Files\Common Files\System\backup.exe
                                                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                          6⤵
                                                            PID:2528
                                                            • C:\Program Files\Common Files\System\ado\backup.exe
                                                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                              7⤵
                                                                PID:2980
                                                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                7⤵
                                                                  PID:2100
                                                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                  7⤵
                                                                    PID:1924
                                                              • C:\Program Files\DVD Maker\backup.exe
                                                                "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                                5⤵
                                                                  PID:2452
                                                                  • C:\Program Files\DVD Maker\de-DE\update.exe
                                                                    "C:\Program Files\DVD Maker\de-DE\update.exe" C:\Program Files\DVD Maker\de-DE\
                                                                    6⤵
                                                                      PID:1052
                                                                    • C:\Program Files\DVD Maker\en-US\backup.exe
                                                                      "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                                      6⤵
                                                                        PID:1604
                                                                      • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                        6⤵
                                                                          PID:2440
                                                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                          6⤵
                                                                            PID:1400
                                                                          • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                            "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                            6⤵
                                                                              PID:448
                                                                            • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                              "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                              6⤵
                                                                                PID:2188
                                                                              • C:\Program Files\DVD Maker\Shared\System Restore.exe
                                                                                "C:\Program Files\DVD Maker\Shared\System Restore.exe" C:\Program Files\DVD Maker\Shared\
                                                                                6⤵
                                                                                  PID:2968
                                                                              • C:\Program Files\Google\backup.exe
                                                                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                5⤵
                                                                                  PID:2612
                                                                                  • C:\Program Files\Google\Chrome\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                    6⤵
                                                                                      PID:360
                                                                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                        7⤵
                                                                                          PID:1904
                                                                                    • C:\Program Files\Internet Explorer\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                      5⤵
                                                                                        PID:1196
                                                                                        • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                          "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                          6⤵
                                                                                            PID:2592
                                                                                          • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                            "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                            6⤵
                                                                                              PID:2784
                                                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                              6⤵
                                                                                                PID:2380
                                                                                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                6⤵
                                                                                                  PID:2892
                                                                                                • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                  6⤵
                                                                                                    PID:1560
                                                                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                    6⤵
                                                                                                      PID:1380
                                                                                                  • C:\Program Files\Java\backup.exe
                                                                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                    5⤵
                                                                                                      PID:1776
                                                                                                      • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                                                                        6⤵
                                                                                                          PID:2812
                                                                                                        • C:\Program Files\Java\jre7\backup.exe
                                                                                                          "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
                                                                                                          6⤵
                                                                                                            PID:324
                                                                                                        • C:\Program Files\Microsoft Games\backup.exe
                                                                                                          "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                                          5⤵
                                                                                                            PID:2220
                                                                                                          • C:\Program Files\Microsoft Office\backup.exe
                                                                                                            "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                            5⤵
                                                                                                              PID:1976
                                                                                                            • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                              5⤵
                                                                                                                PID:1748
                                                                                                              • C:\Program Files\MSBuild\backup.exe
                                                                                                                "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                                                5⤵
                                                                                                                  PID:2132
                                                                                                                • C:\Program Files\Reference Assemblies\backup.exe
                                                                                                                  "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                                                                  5⤵
                                                                                                                    PID:3052
                                                                                                                  • C:\Program Files\VideoLAN\backup.exe
                                                                                                                    "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
                                                                                                                    5⤵
                                                                                                                      PID:1568
                                                                                                                    • C:\Program Files\Windows Defender\backup.exe
                                                                                                                      "C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
                                                                                                                      5⤵
                                                                                                                        PID:536
                                                                                                                      • C:\Program Files\Windows Journal\backup.exe
                                                                                                                        "C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
                                                                                                                        5⤵
                                                                                                                          PID:2260
                                                                                                                      • C:\Program Files (x86)\backup.exe
                                                                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                        4⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        • System policy modification
                                                                                                                        PID:2748
                                                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                          5⤵
                                                                                                                            PID:2976
                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                                                              6⤵
                                                                                                                                PID:1396
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                                                  7⤵
                                                                                                                                    PID:836
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                                                    7⤵
                                                                                                                                      PID:592
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                                      7⤵
                                                                                                                                        PID:2228
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                                        7⤵
                                                                                                                                          PID:1784
                                                                                                                                    • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                      5⤵
                                                                                                                                        PID:1716
                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                          6⤵
                                                                                                                                            PID:2860
                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                                            6⤵
                                                                                                                                              PID:1740
                                                                                                                                          • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                            5⤵
                                                                                                                                              PID:576
                                                                                                                                              • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                6⤵
                                                                                                                                                  PID:2416
                                                                                                                                                • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2008
                                                                                                                                                  • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:568
                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:2224
                                                                                                                                                    • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                                      5⤵
                                                                                                                                                        PID:2168
                                                                                                                                                      • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                                        5⤵
                                                                                                                                                          PID:2500
                                                                                                                                                        • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2796
                                                                                                                                                          • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                                                            5⤵
                                                                                                                                                              PID:1920
                                                                                                                                                            • C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2756
                                                                                                                                                              • C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:1312
                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:1084
                                                                                                                                                                • C:\Users\backup.exe
                                                                                                                                                                  C:\Users\backup.exe C:\Users\
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:2164
                                                                                                                                                                    • C:\Users\Admin\backup.exe
                                                                                                                                                                      C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:1828
                                                                                                                                                                      • C:\Users\Public\backup.exe
                                                                                                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2156
                                                                                                                                                                      • C:\Windows\backup.exe
                                                                                                                                                                        C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1692
                                                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1616
                                                                                                                                                                            • C:\Windows\AppCompat\backup.exe
                                                                                                                                                                              C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:1200
                                                                                                                                                                              • C:\Windows\AppPatch\backup.exe
                                                                                                                                                                                C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1608
                                                                                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2572
                                                                                                                                                                                  • C:\Windows\Branding\backup.exe
                                                                                                                                                                                    C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:2464
                                                                                                                                                                                    • C:\Windows\CSC\backup.exe
                                                                                                                                                                                      C:\Windows\CSC\backup.exe C:\Windows\CSC\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:988
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:2616
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:2532
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:2580
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:2716
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:1916
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\backup.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:2444
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\backup.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:2984
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\backup.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:2824
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\CRX_INSTALL\backup.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\CRX_INSTALL\
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:3024
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:2776

                                                                                                                                                                              Network

                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                              Replay Monitor

                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                              Downloads

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.zip
                                                                                                                                                                                Filesize

                                                                                                                                                                                107KB

                                                                                                                                                                                MD5

                                                                                                                                                                                40df67a09634f9d9ec630b75f4e5bce8

                                                                                                                                                                                SHA1

                                                                                                                                                                                00371ad1f045154f6d366126c6f97cfef2d49600

                                                                                                                                                                                SHA256

                                                                                                                                                                                09180450bc6d02f25699d22bb7742d2c18b8e3bc0de88286f5bf5d7f6c8ef59f

                                                                                                                                                                                SHA512

                                                                                                                                                                                feb1bad4efab5e1b728b9757ecbd48504557260d6ba8d5be2e23fae32d5986982213ec9dcec3c24121c0f9a37ae64cd7227b80b6e52f5b44994ee0f3af5b9ac2

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.zip
                                                                                                                                                                                Filesize

                                                                                                                                                                                22B

                                                                                                                                                                                MD5

                                                                                                                                                                                76cdb2bad9582d23c1f6f4d868218d6c

                                                                                                                                                                                SHA1

                                                                                                                                                                                b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

                                                                                                                                                                                SHA256

                                                                                                                                                                                8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

                                                                                                                                                                                SHA512

                                                                                                                                                                                5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                abc3a2ebb5e06c5c449c520747731b0e

                                                                                                                                                                                SHA1

                                                                                                                                                                                edb170b485f3640e7f3f23b3ea2533aa359184db

                                                                                                                                                                                SHA256

                                                                                                                                                                                e8cc48e7a15788f2f2807bb8d3e1aa43236a16253608b8a09efb2e056ea62b2c

                                                                                                                                                                                SHA512

                                                                                                                                                                                3afce34d678f329161738d212b3993e05436cf7a2ea6bce66eab0f0ebf258365ce35dcdfd51a0d8e9f59356425053ff05c8acc5e015ea3158b99f4186f2a13c9

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                aebf8eae2212e7d80f623744cd1ee298

                                                                                                                                                                                SHA1

                                                                                                                                                                                93806fe2a41d29b2e76565e19446406670535e98

                                                                                                                                                                                SHA256

                                                                                                                                                                                71f5bebcb42f110a6465d2d7d32d4419e8ebaf9015d4d941dc8c83d1587ba9e6

                                                                                                                                                                                SHA512

                                                                                                                                                                                f76ca8246d90551025547c12d98f28389933597cb9024bcf70a410242cf6700c393d7bb302aeb8d56ce6987ac490e943b0323d7fa0df8561aa2c78cb3b140aa8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \PerfLogs\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                4c1e567d4359c39f31a42695ba0b4c8a

                                                                                                                                                                                SHA1

                                                                                                                                                                                d1fe1bfb106fffb23f2a069708fdbe6b37fdfb26

                                                                                                                                                                                SHA256

                                                                                                                                                                                8b9fa3ef7ed616daf035b3bc2556d9848c27d497d63c6a7a5f65f4a7e70aa3cc

                                                                                                                                                                                SHA512

                                                                                                                                                                                81ce9daec8cd298444b8012e5ea8b6c515fcddbc04172eb87ed5d210c760c22a9754d65f53d56cc7a076c04c1af8f887525e695949812457202b1bba6758ee37

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                a4fbad2ab84741f7cc0f14616c071b63

                                                                                                                                                                                SHA1

                                                                                                                                                                                2be281a8170dce4de9b63b878b05677973c1211a

                                                                                                                                                                                SHA256

                                                                                                                                                                                836390917bf19282e72c5401c3069f1be372af9a264fb902a6706bd8a3df18ac

                                                                                                                                                                                SHA512

                                                                                                                                                                                276f922dcb87fb0b2e550e199b1b8dbcb4cb7d3adc1e2d165dd3b154e631639dfe9b8be19fad30516bf58b9751812246d1996455d1ffec08c6dbcbf64ddeb44b

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                5dbe5f099584e5d86bc9f7f94874fcbe

                                                                                                                                                                                SHA1

                                                                                                                                                                                26097aa57b7410c0e2dc4d3aef4cf9e9ad21cd36

                                                                                                                                                                                SHA256

                                                                                                                                                                                205ece9f64c09e71a1e87ca3cd2f8a0a705e79349f5d47d5048103d1ef6ea2c9

                                                                                                                                                                                SHA512

                                                                                                                                                                                be3a01f1d7516a0a913f06e2fa98ba6a9ca3d6ae5bc9aacc9257249976039e4102def3f9e6ce9c46c08391de355364982aee9eb776326fe091dca24e3551a1b8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\1738458047\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                4487ec26764028d404b384804e58df3c

                                                                                                                                                                                SHA1

                                                                                                                                                                                efe711beda75df60d7579e9d671502644c1278f1

                                                                                                                                                                                SHA256

                                                                                                                                                                                74cf595ebb0814dde88bc2e6561cf9a8ce8a23295fdbfc7c330d835e20a9f204

                                                                                                                                                                                SHA512

                                                                                                                                                                                132feb4a8fc9bde1c0d36343a2e7c74aec25dc68e8c572fadc1b550fd18bae30425dd5fd4787c964478a66eeeeda4801e9bce413f5f5f71999b134cdd8269758

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                bd3123bd74af38dc771117cc4f8111ca

                                                                                                                                                                                SHA1

                                                                                                                                                                                0aaeccce0bb1c08f8a427d89ca46f7b3c6ba61cf

                                                                                                                                                                                SHA256

                                                                                                                                                                                591ac5d5cbf1963850f26b6451ce31b3b8752a68fbb0e8074d532e203b986956

                                                                                                                                                                                SHA512

                                                                                                                                                                                fb514964141b678c7320643a1239a7eac9ee9cfc05fb47ccc33bc1801556fc71731c078061e1c37fd25f19c9f976a016e0c7602b2026ccc06bf5b5853f7be6b0

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\backup.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                434KB

                                                                                                                                                                                MD5

                                                                                                                                                                                6e3d6988d3d5d758eb3b5c8afded570a

                                                                                                                                                                                SHA1

                                                                                                                                                                                e4ccabc9e62f36cab76350f3eaa8a33b54c57cb3

                                                                                                                                                                                SHA256

                                                                                                                                                                                8e2a236790c9f707809a9a2249ea77c24d4a00d96d5d13b1d3c732f6fc1eb7bd

                                                                                                                                                                                SHA512

                                                                                                                                                                                067a891660e7ee412bdc30550e602ad246edf833127dd7ab6198f438282aa12fae20ae55f6191e50c09777975eda71df8339006f00bc1091f420b17c859d7d8d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • memory/312-351-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/360-301-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/596-306-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/916-293-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/916-290-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/984-318-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1364-268-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1560-434-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1580-326-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1600-336-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1680-274-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1680-272-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1704-183-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1736-260-0x0000000002FC0000-0x0000000003038000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1736-348-0x0000000002FC0000-0x0000000003038000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1736-332-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1736-288-0x0000000002FC0000-0x0000000003038000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1736-358-0x00000000030C0000-0x0000000003138000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-0-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-23-0x00000000025B0000-0x0000000002628000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-169-0x0000000002670000-0x0000000002671000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-45-0x00000000025B0000-0x0000000002628000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-11-0x00000000025B0000-0x0000000002628000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-53-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-107-0x00000000025B0000-0x0000000002628000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1812-244-0x0000000002670000-0x0000000002671000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1856-236-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1856-315-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1912-391-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1916-75-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-400-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-398-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2288-283-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2312-279-0x0000000002BF0000-0x0000000002C68000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2312-270-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2320-213-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2356-202-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2356-218-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2388-217-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2396-248-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2444-99-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2532-83-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2580-50-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2596-371-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2596-366-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2616-28-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2700-430-0x0000000002720000-0x0000000002798000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2700-439-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2700-421-0x0000000002720000-0x0000000002798000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2700-360-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2716-69-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2728-376-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2764-165-0x0000000002770000-0x00000000027E8000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2764-182-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2776-140-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2824-123-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2832-409-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2948-71-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2948-13-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2952-343-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2964-416-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2984-97-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3012-425-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3024-122-0x0000000000400000-0x0000000000478000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                480KB

                                                                                                                                                                                Download