bdc09fbf...b5ce

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Apollon865.txt.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	297.00 KB
MD5	a37f82d716e96e254a24c45791df752a
SHA1	9dceefab60c0967974a51cead8ca7119d422868e
SHA256	bdc09fbf3df995437454a60067af617551ccddcbbd77eda2bcd03280a269b5ce
SSDeep	6144:c+6V2y9X8RkEld3siHoiPclD1m5IckjNYnQvSP3r6eY05:E8bsLNlDnSP39Y
ImpHash	8478d02078339a5d9a7ab143fc4d5c9e

File Reputation Information

»

Severity	Blacklisted
First Seen	2019-08-29 01:23 (UTC+2)
Last Seen	2019-09-01 05:51 (UTC+2)
Names	Win32.Trojan.Filecoder
Families	Filecoder
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x410cd3
Size Of Code	0x21000
Size Of Initialized Data	0x3f000
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-08-27 15:18:05+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x20fb4	0x21000	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.68
.rdata	0x422000	0x2552a	0x25600	0x21400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.63
.data	0x448000	0x17c80	0x1e00	0x46a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.98
.rsrc	0x460000	0x1e0	0x200	0x48800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.7
.reloc	0x461000	0x18dc	0x1a00	0x48a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.5

Imports (5)

»

KERNEL32.dll (111)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CreateFileMappingW	0x0	0x422024	0x469f8	0x45df8	0x8c
InterlockedPushEntrySList	0x0	0x422028	0x469fc	0x45dfc	0x2f1
MapViewOfFile	0x0	0x42202c	0x46a00	0x45e00	0x357
InitializeSListHead	0x0	0x422030	0x46a04	0x45e04	0x2e7
InterlockedPopEntrySList	0x0	0x422034	0x46a08	0x45e08	0x2f0
GetFileSizeEx	0x0	0x422038	0x46a0c	0x45e0c	0x1f1
SetEndOfFile	0x0	0x42203c	0x46a10	0x45e10	0x453
GetLastError	0x0	0x422040	0x46a14	0x45e14	0x202
SetFilePointerEx	0x0	0x422044	0x46a18	0x45e18	0x467
MoveFileExW	0x0	0x422048	0x46a1c	0x45e1c	0x360
GlobalAlloc	0x0	0x42204c	0x46a20	0x45e20	0x2b3
GlobalFree	0x0	0x422050	0x46a24	0x45e24	0x2ba
FindFirstFileW	0x0	0x422054	0x46a28	0x45e28	0x139
FindFirstVolumeW	0x0	0x422058	0x46a2c	0x45e2c	0x13f
GetCommandLineW	0x0	0x42205c	0x46a30	0x45e30	0x187
FindNextFileW	0x0	0x422060	0x46a34	0x45e34	0x145
WaitForMultipleObjects	0x0	0x422064	0x46a38	0x45e38	0x4f7
GetEnvironmentVariableW	0x0	0x422068	0x46a3c	0x45e3c	0x1dc
FindClose	0x0	0x42206c	0x46a40	0x45e40	0x12e
WaitForSingleObject	0x0	0x422070	0x46a44	0x45e44	0x4f9
GetFileAttributesW	0x0	0x422074	0x46a48	0x45e48	0x1ea
SetFileAttributesW	0x0	0x422078	0x46a4c	0x45e4c	0x461
GetLogicalDriveStringsW	0x0	0x42207c	0x46a50	0x45e50	0x208
CloseHandle	0x0	0x422080	0x46a54	0x45e54	0x52
GetSystemInfo	0x0	0x422084	0x46a58	0x45e58	0x273
CreateThread	0x0	0x422088	0x46a5c	0x45e5c	0xb5
SetVolumeMountPointW	0x0	0x42208c	0x46a60	0x45e60	0x4ab
FindVolumeClose	0x0	0x422090	0x46a64	0x45e64	0x150
CreateProcessW	0x0	0x422094	0x46a68	0x45e68	0xa8
CopyFileW	0x0	0x422098	0x46a6c	0x45e6c	0x75
GetVolumePathNamesForVolumeNameW	0x0	0x42209c	0x46a70	0x45e70	0x2ad
lstrcpyW	0x0	0x4220a0	0x46a74	0x45e74	0x548
FindNextVolumeW	0x0	0x4220a4	0x46a78	0x45e78	0x14a
lstrcmpiW	0x0	0x4220a8	0x46a7c	0x45e7c	0x545
GetDriveTypeW	0x0	0x4220ac	0x46a80	0x45e80	0x1d3
GetExitCodeProcess	0x0	0x4220b0	0x46a84	0x45e84	0x1df
EnterCriticalSection	0x0	0x4220b4	0x46a88	0x45e88	0xee
WriteFile	0x0	0x4220b8	0x46a8c	0x45e8c	0x525
InitializeCriticalSectionAndSpinCount	0x0	0x4220bc	0x46a90	0x45e90	0x2e3
LeaveCriticalSection	0x0	0x4220c0	0x46a94	0x45e94	0x339
SetFilePointer	0x0	0x4220c4	0x46a98	0x45e98	0x466
lstrcatA	0x0	0x4220c8	0x46a9c	0x45e9c	0x53e
DeleteCriticalSection	0x0	0x4220cc	0x46aa0	0x45ea0	0xd1
lstrcpynA	0x0	0x4220d0	0x46aa4	0x45ea4	0x54a
GetComputerNameW	0x0	0x4220d4	0x46aa8	0x45ea8	0x18f
GetSystemTime	0x0	0x4220d8	0x46aac	0x45eac	0x277
WriteConsoleW	0x0	0x4220dc	0x46ab0	0x45eb0	0x524
DecodePointer	0x0	0x4220e0	0x46ab4	0x45eb4	0xca
FlushFileBuffers	0x0	0x4220e4	0x46ab8	0x45eb8	0x157
InterlockedFlushSList	0x0	0x4220e8	0x46abc	0x45ebc	0x2ee
UnmapViewOfFile	0x0	0x4220ec	0x46ac0	0x45ec0	0x4d6
CreateFileW	0x0	0x4220f0	0x46ac4	0x45ec4	0x8f
lstrlenA	0x0	0x4220f4	0x46ac8	0x45ec8	0x54d
lstrcpynW	0x0	0x4220f8	0x46acc	0x45ecc	0x54b
lstrlenW	0x0	0x4220fc	0x46ad0	0x45ed0	0x54e
ReadFile	0x0	0x422100	0x46ad4	0x45ed4	0x3c0
QueryPerformanceCounter	0x0	0x422104	0x46ad8	0x45ed8	0x3a7
lstrcatW	0x0	0x422108	0x46adc	0x45edc	0x53f
Sleep	0x0	0x42210c	0x46ae0	0x45ee0	0x4b2
GetConsoleMode	0x0	0x422110	0x46ae4	0x45ee4	0x1ac
GetConsoleCP	0x0	0x422114	0x46ae8	0x45ee8	0x19a
GetProcessHeap	0x0	0x422118	0x46aec	0x45eec	0x24a
VirtualQuery	0x0	0x42211c	0x46af0	0x45ef0	0x4f1
SetStdHandle	0x0	0x422120	0x46af4	0x45ef4	0x487
SetEnvironmentVariableA	0x0	0x422124	0x46af8	0x45ef8	0x456
GetCurrentProcessId	0x0	0x422128	0x46afc	0x45efc	0x1c1
GetCurrentThreadId	0x0	0x42212c	0x46b00	0x45f00	0x1c5
GetSystemTimeAsFileTime	0x0	0x422130	0x46b04	0x45f04	0x279
IsDebuggerPresent	0x0	0x422134	0x46b08	0x45f08	0x300
UnhandledExceptionFilter	0x0	0x422138	0x46b0c	0x45f0c	0x4d3
SetUnhandledExceptionFilter	0x0	0x42213c	0x46b10	0x45f10	0x4a5
GetStartupInfoW	0x0	0x422140	0x46b14	0x45f14	0x263
IsProcessorFeaturePresent	0x0	0x422144	0x46b18	0x45f18	0x304
GetModuleHandleW	0x0	0x422148	0x46b1c	0x45f1c	0x218
GetCurrentProcess	0x0	0x42214c	0x46b20	0x45f20	0x1c0
TerminateProcess	0x0	0x422150	0x46b24	0x45f24	0x4c0
RtlUnwind	0x0	0x422154	0x46b28	0x45f28	0x418
SetLastError	0x0	0x422158	0x46b2c	0x45f2c	0x473
TlsAlloc	0x0	0x42215c	0x46b30	0x45f30	0x4c5
TlsGetValue	0x0	0x422160	0x46b34	0x45f34	0x4c7
TlsSetValue	0x0	0x422164	0x46b38	0x45f38	0x4c8
TlsFree	0x0	0x422168	0x46b3c	0x45f3c	0x4c6
FreeLibrary	0x0	0x42216c	0x46b40	0x45f40	0x162
GetProcAddress	0x0	0x422170	0x46b44	0x45f44	0x245
LoadLibraryExW	0x0	0x422174	0x46b48	0x45f48	0x33e
RaiseException	0x0	0x422178	0x46b4c	0x45f4c	0x3b1
GetModuleHandleExW	0x0	0x42217c	0x46b50	0x45f50	0x217
GetStdHandle	0x0	0x422180	0x46b54	0x45f54	0x264
GetModuleFileNameA	0x0	0x422184	0x46b58	0x45f58	0x213
MultiByteToWideChar	0x0	0x422188	0x46b5c	0x45f5c	0x367
WideCharToMultiByte	0x0	0x42218c	0x46b60	0x45f60	0x511
ExitProcess	0x0	0x422190	0x46b64	0x45f64	0x119
GetACP	0x0	0x422194	0x46b68	0x45f68	0x168
HeapAlloc	0x0	0x422198	0x46b6c	0x45f6c	0x2cb
HeapFree	0x0	0x42219c	0x46b70	0x45f70	0x2cf
GetFileType	0x0	0x4221a0	0x46b74	0x45f74	0x1f3
CompareStringW	0x0	0x4221a4	0x46b78	0x45f78	0x64
LCMapStringW	0x0	0x4221a8	0x46b7c	0x45f7c	0x32d
HeapReAlloc	0x0	0x4221ac	0x46b80	0x45f80	0x2d2
HeapSize	0x0	0x4221b0	0x46b84	0x45f84	0x2d4
GetStringTypeW	0x0	0x4221b4	0x46b88	0x45f88	0x269
CreateProcessA	0x0	0x4221b8	0x46b8c	0x45f8c	0xa4
GetFileAttributesExW	0x0	0x4221bc	0x46b90	0x45f90	0x1e7
FindFirstFileExA	0x0	0x4221c0	0x46b94	0x45f94	0x133
FindNextFileA	0x0	0x4221c4	0x46b98	0x45f98	0x143
IsValidCodePage	0x0	0x4221c8	0x46b9c	0x45f9c	0x30a
GetOEMCP	0x0	0x4221cc	0x46ba0	0x45fa0	0x237
GetCPInfo	0x0	0x4221d0	0x46ba4	0x45fa4	0x172
GetCommandLineA	0x0	0x4221d4	0x46ba8	0x45fa8	0x186
GetEnvironmentStringsW	0x0	0x4221d8	0x46bac	0x45fac	0x1da
FreeEnvironmentStringsW	0x0	0x4221dc	0x46bb0	0x45fb0	0x161

USER32.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
wsprintfW	0x0	0x422204	0x46bd8	0x45fd8	0x333
wsprintfA	0x0	0x422208	0x46bdc	0x45fdc	0x332

ADVAPI32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegCloseKey	0x0	0x422000	0x469d4	0x45dd4	0x230
RegSetValueExW	0x0	0x422004	0x469d8	0x45dd8	0x27e
RegCreateKeyW	0x0	0x422008	0x469dc	0x45ddc	0x23c
RegDeleteValueW	0x0	0x42200c	0x469e0	0x45de0	0x248
RegOpenKeyW	0x0	0x422010	0x469e4	0x45de4	0x264
CryptAcquireContextW	0x0	0x422014	0x469e8	0x45de8	0xb1
CryptGenRandom	0x0	0x422018	0x469ec	0x45dec	0xc1
CryptReleaseContext	0x0	0x42201c	0x469f0	0x45df0	0xcb

SHELL32.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ShellExecuteExW	0x0	0x4221f4	0x46bc8	0x45fc8	0x121
SHChangeNotify	0x0	0x4221f8	0x46bcc	0x45fcc	0x7f
CommandLineToArgvW	0x0	0x4221fc	0x46bd0	0x45fd0	0x6

MPR.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetEnumResourceW	0x0	0x4221e4	0x46bb8	0x45fb8	0x1c
WNetOpenEnumW	0x0	0x4221e8	0x46bbc	0x45fbc	0x3d
WNetCloseEnum	0x0	0x4221ec	0x46bc0	0x45fc0	0x10

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Points	AV	YARA	Actions
apollon865.txt.exe	1	0x01210000	0x01272FFF	Relevant Image	-	32-bit	-			... Memory Dump Actions Download Dump Go to process
apollon865.txt.exe	1	0x01210000	0x01272FFF	Final Dump	-	32-bit	-			... Memory Dump Actions Download Dump Go to process

Local AV Matches (1)

»

Threat Name	Severity
DeepScan:Generic.Ransom.GlobeImposter.FB749BAD	Malicious

c:\programdata\sun\java\java update\jaureglist.xml.apollon865

Modified File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	896 bytes
MD5	66d140e530a4425f59b7146d5bf87285
SHA1	724d483679304411fb0927b755776a0aeef3b32e
SHA256	b98176e08620312a013136f9e55a5e885ba5533bffafcbeea166a0f4c098b680
SSDeep	24:D/cy5x+7VBJLUPSIgn5DM4Kg103gMhLckwebJs:Dzr+7ZWSIgnGPg23pLFwe9s

C:\BOOTSECT.BAK.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	8.75 KB
MD5	43e579f9fd76d8d4bd15323939d178d6
SHA1	56e349823db894404be5ec67b67a96b935810fac
SHA256	126143db7515dc53c498b86e25f08ea26ef2cb4f58012bd913a351a13e0a3bdc
SSDeep	192:tFExVQjYzKygTHBYx3rstedw+kcWDG0xg0we9s:tZjYObHBcsIwlFzs

C:\Users\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	b77f88b7498fc66fcf4acd9d628fcd31
SHA1	6f0770bf80d3e3e285be3a932af8f6b7f62cd257
SHA256	cc25a7bb1d87f343050dadef0417074bd4f6d4468637e848b7b036ce1900e809
SSDeep	24:wtCsEFHumlcO9RzO6qbIwRgn5DM4Kg103gMhLckwebJs:wtCdFOmN9RNqRRgnGPg23pLFwe9s

C:\Users\Public\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	c6aa95650b4a34228f09b3f2ce78b16a
SHA1	70c5f582f839765e1230d26a487750c135002964
SHA256	5ab287a405b8626fefbddb1e7827420cf3cb114661043f727d09abac4e9cf5fe
SSDeep	24:YGGC9EsqvalQxhtgn5DM4Kg103gMhLckwebJs:HavxhtgnGPg23pLFwe9s

C:\Users\Public\Videos\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.12 KB
MD5	6c01201e60f617a177d9edccd49982a7
SHA1	2a36a5fe59c8a602888337051584ca91e149618c
SHA256	2b85776ef388f16cf00e5fce94eec293b5c9e46b94ce548ee5f66edf8ea1f06e
SSDeep	24:9RacMwu4v6hne2BeP4u799DRllbdk4g7gn5DM4Kg103gMhLckwebJs:lS4vWne8q4u5NRllbdF+gnGPg23pLFwf

C:\Users\Default\AppData\Local\IconCache.db.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	758.73 KB
MD5	22ed81f6a423d62383300188b9ca54f1
SHA1	0b6077860ecb9f5159b830c4e524b7622c493d7e
SHA256	75268090b5079504d4854e1ea0bf4a229bdde269eb225d8aa2656e24a67a3a51
SSDeep	12288:vf3Kizffo11LDcd6SFlrpD+4LWIansmtV5skkrQUIoTcq4y4u8MbhRI7/hbMuSaK:vf3Kizc1XurA3IansYqRIoTgW8aRI7Zm

C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	10.70 KB
MD5	b60565647c3d890d6ee502d29014552b
SHA1	a06f4993cf8c845dea39975e6cccca44537d3a47
SHA256	87c7740ddce9ac7c536014e71973e9cd4d457ddd7f10d8de025c484f5e0ad30f
SSDeep	192:mjJP2yWk/C3wo4Yzan6RuQae9NrSC9dw0lUyg9diUOzkTkQa7TPtg0we9s:gtzBa3wYc9evrSCLrYdixz83an/s

C:\Users\Default\AppData\Local\Microsoft\Windows Mail\oeold.xml.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 KB
MD5	3e5a4dee1193d233ff5c3881dfbd62a4
SHA1	bb860c4d3bdd00b5889ab963545b63563572be17
SHA256	ed2008c4f1b025375317098f01e642d67f79dfb579145bb37ab6801b58a18d9d
SSDeep	24:zPG8xb97hCqvi6LiN6hOh7pgn5DM4Kg103gMhLckwebJs:zPzlwqViWO7gnGPg23pLFwe9s

C:\Users\Public\Videos\Sample Videos\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.08 KB
MD5	d03bf7bd559a3b4ad343c5a2e30b0950
SHA1	c35443ad5f2c2cf921a8b06d7d705b2677e4b547
SHA256	acffb16d830ba0e15d20389f123fd6b195ada971de6adbd06ec3c43c9f7f34c8
SSDeep	24:i0mdeVEN6SWmKFotpM/EYo0wUdA/bqgn5DM4Kg103gMhLckwebJs:i0semNSmKODaZbwd/bqgnGPg23pLFwee

C:\Users\Default\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.02 MB
MD5	2a11c2b9ed4aa325eb3e7f01d395639c
SHA1	085260a47cef6dfebdbd750111d74ac68672d153
SHA256	be26387a2a73a59f14a6c6f51743cca3dfdd55ba79a179ed3d99cfbf77bd475d
SSDeep	24576:Y4HVV74l1MFljhLz6YrOWbjwAA2KvwCV0lNE7xCg/ZwuoA3GyMAns:Y4HVVxFLzrHbsbvtKKdwuLGyns

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	25.03 MB
MD5	e9f4beaacd3ca0eb8273e524aa2e69d6
SHA1	00b1ec35a7cee857ec4c71f80372c21298010ded
SHA256	5a80027a9685a351cff8d06aa7ff550a6ea44a6d0bdae00cdc149086ed26c816
SSDeep	196608:dVZKdI6NFLBD3kjtHXo+5/9xM+Z2i0SOIeFlfZ8lPQGvwGj5Yza:/MO6v9wjf/zMw0SZeFZwPQGj

C:\Users\Default\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	68.86 KB
MD5	03acf1156356c702a7698e85c9517be7
SHA1	fe884f7eebde0c61abf6e78a4dcb9a297b32391f
SHA256	f6ce12cf4255fb0f7f44406444356c2a92207be595d7646214df9b80d8bc4730
SSDeep	1536:T6VeAANvXyTyqWdiLooPFyVvJLJ4dMqpXGKVQemeZ+bvZzs:T6BANvyJL3P+RLJ4d5WyJZ+bv5s

C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	12.67 KB
MD5	65e41a4fd2870beefffd9fbd4f284ef4
SHA1	79009f854c032ef027e07777e6d319fb04712d01
SHA256	c2fa6085ab385f5e134d5ddaaf3f7d0f7c2570a0354031556930159ae94a608e
SSDeep	384:Vsx/2iiDJLfWcHMlhItZJKHw7n0zkMD1vHKs:6uiiUlhItZJwwz0zRCs

C:\Users\Public\Recorded TV\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	848 bytes
MD5	8f7191d4f2cc62f3d16783f984cb8b7b
SHA1	88ac0b66fab92514003aa2b78a8a4ff09c883dcf
SHA256	3a078f506eb123140dfd1606bfdca7d7e3454402ad398212bb7fe6b9ea1c92c7
SSDeep	24:u6Q2rMK5I1bgn5DM4Kg103gMhLckwebJs:uZG5I1bgnGPg23pLFwe9s

C:\Users\Public\Recorded TV\Sample Media\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	b2f90987a54b1faf82af755e52938e5f
SHA1	223d23f7e274f6d12ae6850f107132e848e01c20
SHA256	02bdf46f303550028bda758715e091fc5ffb63deaa137a299227c22e779d4c40
SSDeep	24:ozumFbt98zaDhzgn5DM4Kg103gMhLckwebJs:ozu4HZgnGPg23pLFwe9s

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ids.txt

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	4.75 KB
MD5	002da2794a278a8cc4bc1853ac8a38ab
SHA1	a8542271d32d2e6a619c823e1ec3c7f5c02ff856
SHA256	8cc3863150cda357063cfbb576f87e6734839dd6d6eeae6c7b80ac34ce88cefe
SSDeep	96:HE0QBEFId34N4Jj0mSAbUbWbq/bq5bqBh4vhoqrDvf7xWcaBrFiB:kWWp4N6phrDvf74caBrFs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\cert8.db.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	64.75 KB
MD5	b266feeb4b6cf514f7f574a0b3b07159
SHA1	b32a17a09e61b35ce8b1522d7fa93df96d03f48c
SHA256	34d87c2e730740b3fb38e2d3d3dbdb9b58a9603a307a9d9e7983deca8795414e
SSDeep	1536:6otkoXv/cp9j9/PGhXkc0wxIEadtodDt0/Rmus:6voXHcT9/uV0wxIHt2DUmus

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\content-prefs.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	224.75 KB
MD5	c0413c161255c439697c61c69b06ebad
SHA1	df64822f592b41f773e90f68c8b669bd66072d0a
SHA256	4a891e7e159b1714eeb31588c19ba9899cac90ca2103106477580571cbd95f1b
SSDeep	6144:qo0AlcSTnyboa/tz9TFEuKeGske72o1NuwJliAPIcs:RZyUe9eeGHe7zpiEIcs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\cookies.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	512.75 KB
MD5	82956cb58e63b3f265b76cdb58aabab9
SHA1	6894ec7f834016dedd3871269b2de653ae022647
SHA256	0dcceaa9eda0280ec9541bdca1499b022d6927423f823a39fb8f2ac7f8fede77
SSDeep	12288:jX8E8J4TPHZ9foip03pZieyCWKFaDfoLz72xMx1dDu7hs:z0JGv7F83inzoz2Q1k7hs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\downloads.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	96.75 KB
MD5	61f065995825596fdb3b018b38f562fd
SHA1	f7ff51c8f555e7091bbf53a0641e5a6afae58835
SHA256	06b9b1f116d3d7048f55f2fe0373fd03ec0d29684b3f0d488050e5eba96e0220
SSDeep	1536:f3mJFqGjZpzthG49+3PseOlm7S4Sr1t1FKNsGhCfQ6Ed7RbXIPDST3s:fmxZ1CPsPwMJtih6w1yW7s

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\extensions.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	448.75 KB
MD5	2c60bdcb540c0f51b517c7299dcfe750
SHA1	1334030c613577cceb68f8b793f4ad4d6b6b9cf5
SHA256	1f35ac38575a190fcfa78e240503b055c7b0e9fa49cb45f65870d0d4d71c67f5
SSDeep	12288:i4JbAQgedd2PMkRzHQUdXpA+WAm8N13ROus:i4HQHx9d5lWn874us

C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	9.25 MB
MD5	d71309bd05c1157907c6cebbd88b7d26
SHA1	c68bb6acfa2c3263d5fd768eafadb3dc871ac5e6
SHA256	8821abcdd065f44b3f022ce667fdbdb5d34a9ba7a2cc5819e8429b5e97309674
SSDeep	196608:wTGaQpyZXsYwp7n3qzsmmQ7tbq6jZCzZTlkcEEnluDbBHsz8LDa6HojGEo2ijtRp:w/OyZXnYDqZmQ7djSgIluug/a3u32NIB

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\key3.db.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	16.75 KB
MD5	970ed590aa06ab509b0a087f39f8a758
SHA1	1ed821b7c04cf49b24cc11257d22103e16658968
SHA256	ba6c7c27cd0b90689d7237148e11d34a1dec5e59f6a2c8776ce7caa2f6f178f1
SSDeep	384:9n6HwsDf5bFybqmt41SUpya2JMlpQPslVtH8O3HWJuipUzGNms:x6Hw0f5ZYdm8U85MC4tcO3HWJuipU6NN

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\permissions.sqlite.Apollon865

Dropped File

Compressed

Unknown

»

Mime Type	application/zlib
File Size	64.75 KB
MD5	009d2d21b3b310f04bae6abe8d146f53
SHA1	a9e9dbfcc43fb5d32f791baa2e26356525f25231
SHA256	603d22a3e335fb9d03469620ea7f01416133396ecd344bef98272c6b5e918210
SSDeep	1536:dPmRLQOeSDJnU6gKwYgktPsnfHVqRPrEG5x/T0RULXh/lps:dPmR0OeSDJnfCBktPMVi5x/T9s

C:\Users\Public\Pictures\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.12 KB
MD5	8ef40664abb24409dff1f469df7c0880
SHA1	ef83c1d6a40f4b7c6f15e0fb04c673475c84cd53
SHA256	8f72e0805be14060e3927f630771613eba143fa2369bce041b49e7544246a2e8
SSDeep	24:ttfCx2Q88gbtAD4LwLleZsHoPg8wIsxgn5DM4Kg103gMhLckwebJs:ttg83xLLwLUFPNggnGPg23pLFwe9s

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	859.55 KB
MD5	5859ad573a8a773499923360fa0fd0d3
SHA1	e93294c6e91f0e8bfaf3a32ec28ef9e1b1c5642e
SHA256	3f2cfab2c4fa7bb028dcb5df8905a5a6b2f76d5cbdd3aecf6c518f24a47c8e92
SSDeep	24576:oJdUg2LeXQYT48jQGL+CF6GvDYVGJskxEs:+CSXQA48jQwZDYVGJskys

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	826.88 KB
MD5	0727feb7b7592dfe5e8586c1bf650d23
SHA1	6ff1eee2060cb15dd4fdf4ff4e35083dfd95e3f7
SHA256	ed82be017900ebf5ce0d10ded01689e725ad13a66b60f6f181587a23d24e447a
SSDeep	12288:evNxUH6nARh6FYpl8FG33iVMvH2szXzr53f2FG+CIGzXW0nauGWgZb4qJDRyB5EA:ekH4AyYplcIvvH2s3xuFG20au2QSEpYs

C:\Users\Public\Pictures\Sample Pictures\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.84 KB
MD5	1687a69e2b4d5131f58f32def044d28a
SHA1	2ea24fb2a693ce7353fe68d75662f72f1f743372
SHA256	9c1dbce836d456bc946b475f3a333f0f710a6ae0fc15edcdf98fa37cd485d3f1
SSDeep	48:w1vooeBmGN29mYy/skie4h+fzSUcShIygnGPg23pLFwe9s:w5ooeBl2IY/bqzbHPg23we9s

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	582.09 KB
MD5	8a2699f83299130a34b91a97289c94d3
SHA1	7e814f1d657adeed8de69b04c15cbe2284e33f5f
SHA256	2a9b5902194367e2bdfbc53a06cc70fdcf3d6b8690e59a8ebecfcd4c50696f7c
SSDeep	12288:5ltwhkMoiLUy+TRX6U3gNg4HIhD7SYNIo5DWCq0gT/5VC78ak7FbhuMus:nS2kYTRXtwNZohD7SoZ5P3qVk8aUIs

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	758.28 KB
MD5	88f879fee995c6f7a4bce0e00479e8d3
SHA1	6ee7fd3a34180c3c6da9abaff02ca938241ee363
SHA256	3c16c4608440131332af6963bc30da81b12f3de0b043050e787fb28c93250b7e
SSDeep	12288:vHNkulV4ZYRH6HELXQ43fiI2DpPbLwcgpgp4BSygjB4xXDQ4vnFyrsefxJTDcM+T:fNkUiYmcA4tcoBShB4xXDQSFyffxJMLT

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	763.28 KB
MD5	ae3e92eeb32100a5324209274d8e28a2
SHA1	d9b2b12b8cf09c9f7084c8ea559f739d8da2e2e5
SHA256	1a29641d9cb9d800a35eaf1838c526e1045de94665e0f075e10bea65f7f78110
SSDeep	12288:hHO4Ao4KUSFKRyEycO9voGX9UV+phmybJwDR2vWRAsQNEzekpPtAPdSJobbJQLI3:hT1USFKRyEyc7G2V+2yaD4W9iEz/WIhU

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\places.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	10.00 MB
MD5	f9b8527b5ea271575297afe566d82489
SHA1	68e18ae88e4cc3230ee805339fd7a94ab50e5dfb
SHA256	7eaf26cfbc077ee01f6db41bc0c2ea40e10b0a3ee36ce544afd94e48688835df
SSDeep	49152:zgkB8b0tFhNT8xI/V1YZDkI9rFe2gBg4w1TNe1j:z+b0tFhNT9/9ercg4Y

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\secmod.db.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	16.75 KB
MD5	35659bddbfce815f2633c8a9431e0af4
SHA1	9fa4e0af1d2ffa8f2177775581ed56d138a92a30
SHA256	d3f4d6659d36bfdcb9a4b55dd3cdf69009d71c697e8e69b8f04a265897f2b1dd
SSDeep	192:ZU6REj5dtJVSu6leEt6BZpIr10F2NqQxlYzl2ieqeVtPekWXnjPb5f84rf7nIHH1:qr5dtJVSumWF2NPCz13qezrb5zOPVLUs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\sessionstore.bak.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.72 KB
MD5	69576a95d1e551ff44ef002078ce8455
SHA1	ed079f8a49b6c393ba0242e015d2d53b3f7bffcb
SHA256	ed2955c5a7fbc677334dda79147d0f029d8a8d92f730b3f0d43d41131fe37fcd
SSDeep	48:2eQQmPGPOGvzUQ8yaltY0RYMtQ3+94zG+gnGPg23pLFwe9s:2BbPrGbUDyaltPR43LG0Pg23we9s

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\signons.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	320.75 KB
MD5	7beab115947cb24194eb1ea1d0ad3bac
SHA1	7f234d91165b5fae76023a154fa2c86cf8211eee
SHA256	0a03a64971bb537b9eafd5470f257863aef13ff1c817f9fdd392ad366ccbeaab
SSDeep	6144:TRp/nIjoYI8OARxkNKMXuwOXEqNl9GYmbyxCKs:PnI3BrANK2O0gQykKs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\webappsstore.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	96.75 KB
MD5	7177eb3c58ca4a83a607794076cad26e
SHA1	d0eaa2aaf230891b5a42eff844f04de71ba936a3
SHA256	a6bdf7b668052dcf7e1fe7a58a031a9702d1dac92a1995c3eae62b39280acd04
SSDeep	1536:cgzcsD9muyK8ZTJQeogWrtstD4dXP3fLXCECP8FOh2LkCRDmnafI41VF9QkBQ1rk:cicCguWt6eKRBJ7W0F5RiUn1Kdps

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.Apollon865

Dropped File

Audio

Unknown

»

Mime Type	audio/x-mp4a-latm
File Size	548.88 KB
MD5	e8fd36ff30deb2575657f617af897f77
SHA1	5e38a86de781f299f92a89be2f1a46884d921394
SHA256	59103e885777cfd1285735402b46d8418e63b65b92e55e91a6344936ed008613
SSDeep	12288:yenPOkin63IXjJhwkKq8SaL72Iw6OQ1fDPGj4bifMRDrXNs:tn864thTKJWHYyeYCNs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht.sqlite.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	640.75 KB
MD5	1b08a3ee70d1c40e6675021486e03fd8
SHA1	5cb02b57565f1f0913bd66d3797912cf0ea7cca9
SHA256	a158cc3812f512ccd19ab5ccddff8b63d76a1ea61b35c91161a350d88fed0c10
SSDeep	12288:r0QqOWahIhttyuVWilye61/PtF6lOepS5a0sTH/B+7YLiOs5Qs:r0POWaejr4iZ69PtiO5a0sTfBiYLiOPs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	944 bytes
MD5	c2e5f1cbc27ea05017cec6c1ed6fb390
SHA1	91dae16ff091c4404a1cb49d22898aebdcb7377d
SHA256	9321aff8b6c88010aab5eb4a1835a6ba5e85743270641a30f97c2ce4e3c08b53
SSDeep	24:IXKq/4CR926p6Ggn5DM4Kg103gMhLckwebJs:ezvY6p6GgnGPg23pLFwe9s

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	3.17 KB
MD5	b1d9fe5f4bf0dd615cebd69bd79f9937
SHA1	6f1ef239ad08cda309988eecf28039a3bfd2cf84
SHA256	5e407761effa0c42051162710d394a911f7aabaa4df1f8365f8d8aee5e892887
SSDeep	48:VMpnexX2BVDRymNeShLIgXWjwuJ3t3pdxY3XarlVU+CAehOZ4iKsCgqrzm1JcI5K:VNXqRyAkpxt3pd+yeOQaJcIBPg23we9s

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	760.36 KB
MD5	29464c3b2f6519ac718982908d09dd6f
SHA1	623dfc8590c18c1fe92d993ba2834c6bcbef9b5b
SHA256	89194a23c4d4856b90350c47dc9933f9f608ed30103ea733dae025810e9858da
SSDeep	12288:HEDCzzOZcTpGuF1k9j81s2UYQWjcThFhFFnImhhFXs9GD0WdbjhIpne9+IfMhUE7:dfOZclkV81CWo1zIGhC9rWrIw9BkLLyO

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	607.09 KB
MD5	f573d9902d149bb753fb3a3c135dcc03
SHA1	af4609c38370f32e78a297a867d015f6e993ed95
SHA256	2022a443dff4a1eb4f4e0dbbd762842be4a91ad6009fa6eda10445c059ef2ec7
SSDeep	12288:Da2U+sCNyMojEn+HS66f/SgKgf62ug3/jJsGhs/FJ6EJHs:+BcgMWEnAS6Y/SgKgf62FNshFJ60s

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\www.msn[1].xml.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.58 KB
MD5	05ee84e7a8b23286d892d2e603a837f5
SHA1	1de47d4378dc187c7f09ab90ba73e9cc3145051c
SHA256	cc6de42d9f8d5fc42d473fbf56291a99d954ccebfa42fe34f49057896f8baafa
SSDeep	48:GUvupb/eYhpbmNihD+BWgnGPg23pLFwe9s:tvvYhpbmoYsPg23we9s

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\www.google[1].xml.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	784 bytes
MD5	655e92de6e3a272cf80866299e7601b3
SHA1	a957ff557ccf0f3b6b2e2948cd4615656df278cc
SHA256	4779058e8c68d6f475cf34c457b22dad57b4c78641255bf6608c3a292cac7a09
SSDeep	12:R2VtV5JwxdHKl6JPlqFn5R1vsh4Kg1jk/3g4XhLckDsvmbJs:oxIaAgn5DM4Kg103gMhLckwebJs

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\imagesrv.adition[1].xml.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	784 bytes
MD5	7ad7cef6737d64bd6d83bedabd75b870
SHA1	2d58c08f6968d7322e908709ab6646baa437e606
SHA256	6bc920ead781511883c3acc9399263b19635583fb97b8502f49493f1a75f99db
SSDeep	24:DHyBIxHPa8ggn5DM4Kg103gMhLckwebJs:DFhggnGPg23pLFwe9s

C:\Users\Public\Music\desktop.ini.Apollon865

Dropped File

Stream

Unknown

»

Mime Type	application/octet-stream
File Size	1.12 KB
MD5	ebdf7e83805f00e7ae6fed0b0988a15d
SHA1	f05e755cae3d9788ab8b5c54157fdb91219500e7
SHA256	afa2d94726129413e4b36354f2ec4b6979260d47211d76587d59cf967f467a2f
SSDeep	24:r8pFwgAzJk7I55mq4gn5DM4Kg103gMhLckwebJs:r83w1ziE5EgnGPg23pLFwe9s

C:\Users\Default\AppData\Local\Microsoft\Media Player\HOW TO BACK YOUR FILES.exe

Dropped File

Binary

Unknown

»

Also Known As	C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Crypto\RSA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Downloads\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Recorded TV\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\tmp\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Downloads\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\KQMHSVKD\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\moz-safe-about+home\idb\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Favorites\Links\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Credentials\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\temporary internet files\how to back your files.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qupQREdDvXDtuUs-nT\KX4WArEOP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\LocalCopy\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Music\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Support\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Adobe\ARM\Reader_10.0.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\Hzmu\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP12\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Headlights\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Word\HOW TO BACK YOUR FILES.exe (Dropped File) c:\programdata\microsoft\windows\start menu\how to back your files.exe (Dropped File) C:\Users\Default\Searches\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft Help\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\bookmarkbackups\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\network shortcuts\how to back your files.exe (Dropped File) C:\Users\Public\Desktop\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\Recent\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Adobe\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Documents\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\local\microsoft\windows\history\how to back your files.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Credentials\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\WwanSvc\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Adobe\Acrobat\10.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Adobe\ARM\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\klDrs 2\sCh6VoGm3PBEmduP0_I\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\D68G7BIJ\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Links\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Network\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\NetFramework\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\P7Y3F7QB\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\OFFICE\UICaptions\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\36USA68T\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Event Viewer\Views\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Favorites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\LogTransport2\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Videos\Sample Videos\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Music\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\History\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\A4JJDXZF6um92en\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\1033\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\sendto\how to back your files.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\moz-safe-about+home\idb\818200132aebmoouht\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Searches\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\webapps\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\X0JMpELFNa\6eM5vJeVl2WNst9pxsqF\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Contacts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Assistance\Client\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IME12\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Links\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Mozilla\logs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP8_1\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\MSDN\8.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Oracle\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Search\Data\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Documents\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP9_0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Adobe\Acrobat\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\templates\how to back your files.exe (Dropped File) C:\ProgramData\Microsoft\IdentityCRL\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP9_0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\User Account Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\eHome\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\tmp\si\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\LocalLow\Microsoft\CryptnetUrlCache\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\indexedDB\moz-safe-about+home\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\start menu\how to back your files.exe (Dropped File) C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IMJP8_1\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\6ASVN7J7\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Favorites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\AY721QDR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1PE8K\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Libraries\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Adobe\Acrobat\10.0\Replicate\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Word\STARTUP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\65UX3YG0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\WYOVGq\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qupQREdDvXDtuUs-nT\KX4WArEOP\oPo6EGkCAMD\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\WYOVGq\fWMdzf4\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Videos\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\RAC\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\IMJP12\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Recorded TV\Sample Media\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\X0JMpELFNa\vITkbYTcVnkfQOzJRpm\HOW TO BACK YOUR FILES.exe (Dropped File) c:\programdata\microsoft\windows\templates\how to back your files.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\AssetCache\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\UV0DUWVB\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\1NBUR4HR\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Linguistics\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Music\Sample Music\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\MSDN\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Identities\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\klDrs 2\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Assistance\Client\1.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Mozilla\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\WYOVGq\lqRmsUEhIDzR1\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\security\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Protect\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\templates\how to back your files.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7yy1j31jF02aJndzSJq\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Profiles\silmbjec.default\minidumps\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Search\Data\Applications\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\ULhWU\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\S-V8p_Ll9yKSvY\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Extensions\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\RSA\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSScan\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\RAC\StateData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Media\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\network shortcuts\how to back your files.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\how to back your files.exe (Dropped File) C:\Users\Default\Saved Games\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\recent\how to back your files.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\eHome\logs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Favorites\MSN Websites\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\cookies\how to back your files.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Credentials\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Assistance\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Favorites\Windows Live\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\UProof\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Videos\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Proof\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\Device\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\OFFICE\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\Keys\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\MF\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1PE8K\e5e zfC0T_Di\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Favorites\Microsoft Websites\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\Connections\Pbk\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\Desktop\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Excel\XLSTART\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\yXk3_kByU\4mOjK9TTSmSvCmn1hP\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\AddIns\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\VISIO\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MS Project\14\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Media Player\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qupQREdDvXDtuUs-nT\6MT7RF\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Crypto\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\printer shortcuts\how to back your files.exe (Dropped File) C:\Users\Default\AppData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Music\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Documents\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Vault\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Pictures\Sample Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\Services\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Network\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\DRM\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\sendto\how to back your files.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Quarantine\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Search\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\PowerPoint\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Network\Downloader\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Sun\Java\Java Update\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Linguistics\Dictionaries\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Device Stage\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\DRM\Server\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Sun\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Event Viewer\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\X0JMpELFNa\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Forms\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Flash Player\AssetCache\D5NTRC6R\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Excel\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qupQREdDvXDtuUs-nT\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Network\Connections\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Mail\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Definition Updates\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\fJQeYltRV\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\IME12\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Public\Pictures\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\MMC\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Collab\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\VRLZOZ0E\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\LocalLow\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Sun\Java\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\RAC\PublishedData\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qupQREdDvXDtuUs-nT\KX4WArEOP\7mjzYY\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\RAC\Outbound\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Microsoft\DeviceSync\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Speech\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VGMTOI09\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\Default\AppData\Local\Microsoft\Feeds\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hAi8-2ik1bCNPces5Q\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\how to back your files.exe (Dropped File) c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\cookies\how to back your files.exe (Dropped File) C:\ProgramData\Microsoft\Crypto\DSS\HOW TO BACK YOUR FILES.exe (Dropped File) c:\users\default\appdata\roaming\microsoft\windows\recent\how to back your files.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\DZBKZBIC\HOW TO BACK YOUR FILES.exe (Dropped File) C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\HOW TO BACK YOUR FILES.exe (Dropped File) C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3O75JDME\HOW TO BACK YOUR FILES.exe (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	119.00 KB
MD5	767cd62c28f84d087c345eff5e47edc7
SHA1	545ec52d816e63e38eafa6c85030424ad8f378e8
SHA256	2ec0f8935759d0a96bc0e16c044d5f645495d6fbcf7289e6beba3182c52e322b
SSDeep	3072:Kmnc/ksDE9qVm5IcZ6m3zeRGjXC55lQpjYnSnvS9RL7L:FclD1m5IckjKjYnQvSP3
ImpHash	567270df66f047a5516f09b57de89287

PE Information

»

Image Base	0x400000
Entry Point	0x401af4
Size Of Code	0xfe00
Size Of Initialized Data	0xe400
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2019-08-27 15:03:08+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0xfc2b	0xfe00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.62
.rdata	0x411000	0xbcd2	0xbe00	0x10200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.79
.data	0x41d000	0x1290	0xa00	0x1c000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.17
.rsrc	0x41f000	0x1e0	0x200	0x1ca00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.71
.reloc	0x420000	0xf94	0x1000	0x1cc00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.45

Imports (4)

»

KERNEL32.dll (67)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
lstrlenW	0x0	0x411000	0x1c540	0x1b740	0x54e
lstrlenA	0x0	0x411004	0x1c544	0x1b744	0x54d
CreateFileW	0x0	0x411008	0x1c548	0x1b748	0x8f
CloseHandle	0x0	0x41100c	0x1c54c	0x1b74c	0x52
InitializeSListHead	0x0	0x411010	0x1c550	0x1b750	0x2e7
GlobalAlloc	0x0	0x411014	0x1c554	0x1b754	0x2b3
GlobalFree	0x0	0x411018	0x1c558	0x1b758	0x2ba
DecodePointer	0x0	0x41101c	0x1c55c	0x1b75c	0xca
FlushFileBuffers	0x0	0x411020	0x1c560	0x1b760	0x157
SetFilePointerEx	0x0	0x411024	0x1c564	0x1b764	0x467
GetConsoleMode	0x0	0x411028	0x1c568	0x1b768	0x1ac
GetConsoleCP	0x0	0x41102c	0x1c56c	0x1b76c	0x19a
GetProcessHeap	0x0	0x411030	0x1c570	0x1b770	0x24a
SetStdHandle	0x0	0x411034	0x1c574	0x1b774	0x487
LCMapStringW	0x0	0x411038	0x1c578	0x1b778	0x32d
FreeEnvironmentStringsW	0x0	0x41103c	0x1c57c	0x1b77c	0x161
GetEnvironmentStringsW	0x0	0x411040	0x1c580	0x1b780	0x1da
GetCommandLineW	0x0	0x411044	0x1c584	0x1b784	0x187
GetCommandLineA	0x0	0x411048	0x1c588	0x1b788	0x186
GetCPInfo	0x0	0x41104c	0x1c58c	0x1b78c	0x172
GetOEMCP	0x0	0x411050	0x1c590	0x1b790	0x237
IsValidCodePage	0x0	0x411054	0x1c594	0x1b794	0x30a
UnhandledExceptionFilter	0x0	0x411058	0x1c598	0x1b798	0x4d3
SetUnhandledExceptionFilter	0x0	0x41105c	0x1c59c	0x1b79c	0x4a5
GetCurrentProcess	0x0	0x411060	0x1c5a0	0x1b7a0	0x1c0
TerminateProcess	0x0	0x411064	0x1c5a4	0x1b7a4	0x4c0
IsProcessorFeaturePresent	0x0	0x411068	0x1c5a8	0x1b7a8	0x304
QueryPerformanceCounter	0x0	0x41106c	0x1c5ac	0x1b7ac	0x3a7
GetCurrentProcessId	0x0	0x411070	0x1c5b0	0x1b7b0	0x1c1
GetCurrentThreadId	0x0	0x411074	0x1c5b4	0x1b7b4	0x1c5
GetSystemTimeAsFileTime	0x0	0x411078	0x1c5b8	0x1b7b8	0x279
IsDebuggerPresent	0x0	0x41107c	0x1c5bc	0x1b7bc	0x300
GetStartupInfoW	0x0	0x411080	0x1c5c0	0x1b7c0	0x263
GetModuleHandleW	0x0	0x411084	0x1c5c4	0x1b7c4	0x218
RtlUnwind	0x0	0x411088	0x1c5c8	0x1b7c8	0x418
GetLastError	0x0	0x41108c	0x1c5cc	0x1b7cc	0x202
SetLastError	0x0	0x411090	0x1c5d0	0x1b7d0	0x473
EnterCriticalSection	0x0	0x411094	0x1c5d4	0x1b7d4	0xee
LeaveCriticalSection	0x0	0x411098	0x1c5d8	0x1b7d8	0x339
DeleteCriticalSection	0x0	0x41109c	0x1c5dc	0x1b7dc	0xd1
InitializeCriticalSectionAndSpinCount	0x0	0x4110a0	0x1c5e0	0x1b7e0	0x2e3
TlsAlloc	0x0	0x4110a4	0x1c5e4	0x1b7e4	0x4c5
TlsGetValue	0x0	0x4110a8	0x1c5e8	0x1b7e8	0x4c7
TlsSetValue	0x0	0x4110ac	0x1c5ec	0x1b7ec	0x4c8
TlsFree	0x0	0x4110b0	0x1c5f0	0x1b7f0	0x4c6
FreeLibrary	0x0	0x4110b4	0x1c5f4	0x1b7f4	0x162
GetProcAddress	0x0	0x4110b8	0x1c5f8	0x1b7f8	0x245
LoadLibraryExW	0x0	0x4110bc	0x1c5fc	0x1b7fc	0x33e
RaiseException	0x0	0x4110c0	0x1c600	0x1b800	0x3b1
GetStdHandle	0x0	0x4110c4	0x1c604	0x1b804	0x264
WriteFile	0x0	0x4110c8	0x1c608	0x1b808	0x525
GetModuleFileNameA	0x0	0x4110cc	0x1c60c	0x1b80c	0x213
MultiByteToWideChar	0x0	0x4110d0	0x1c610	0x1b810	0x367
WideCharToMultiByte	0x0	0x4110d4	0x1c614	0x1b814	0x511
ExitProcess	0x0	0x4110d8	0x1c618	0x1b818	0x119
GetModuleHandleExW	0x0	0x4110dc	0x1c61c	0x1b81c	0x217
GetACP	0x0	0x4110e0	0x1c620	0x1b820	0x168
HeapFree	0x0	0x4110e4	0x1c624	0x1b824	0x2cf
HeapAlloc	0x0	0x4110e8	0x1c628	0x1b828	0x2cb
HeapReAlloc	0x0	0x4110ec	0x1c62c	0x1b82c	0x2d2
HeapSize	0x0	0x4110f0	0x1c630	0x1b830	0x2d4
GetFileType	0x0	0x4110f4	0x1c634	0x1b834	0x1f3
GetStringTypeW	0x0	0x4110f8	0x1c638	0x1b838	0x269
FindClose	0x0	0x4110fc	0x1c63c	0x1b83c	0x12e
FindFirstFileExA	0x0	0x411100	0x1c640	0x1b840	0x133
FindNextFileA	0x0	0x411104	0x1c644	0x1b844	0x143
WriteConsoleW	0x0	0x411108	0x1c648	0x1b848	0x524

USER32.dll (13)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegisterClassExW	0x0	0x41112c	0x1c66c	0x1b86c	0x24d
UpdateWindow	0x0	0x411130	0x1c670	0x1b870	0x311
PostQuitMessage	0x0	0x411134	0x1c674	0x1b874	0x237
GetClientRect	0x0	0x411138	0x1c678	0x1b878	0x114
GetWindowLongW	0x0	0x41113c	0x1c67c	0x1b87c	0x196
SetWindowLongW	0x0	0x411140	0x1c680	0x1b880	0x2c4
DefWindowProcW	0x0	0x411144	0x1c684	0x1b884	0x9c
CreateWindowExW	0x0	0x411148	0x1c688	0x1b888	0x6e
GetSystemMetrics	0x0	0x41114c	0x1c68c	0x1b88c	0x17e
GetMessageW	0x0	0x411150	0x1c690	0x1b890	0x15d
ShowWindow	0x0	0x411154	0x1c694	0x1b894	0x2df
DispatchMessageW	0x0	0x411158	0x1c698	0x1b898	0xaf
TranslateMessage	0x0	0x41115c	0x1c69c	0x1b89c	0x2fc

ole32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
OleUninitialize	0x0	0x411164	0x1c6a4	0x1b8a4	0x149
OleSetContainedObject	0x0	0x411168	0x1c6a8	0x1b8a8	0x146
OleCreate	0x0	0x41116c	0x1c6ac	0x1b8ac	0x119
OleInitialize	0x0	0x411170	0x1c6b0	0x1b8b0	0x132

OLEAUT32.dll (6)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysAllocString	0x2	0x411110	0x1c650	0x1b850	-
SafeArrayCreate	0xf	0x411114	0x1c654	0x1b854	-
SafeArrayAccessData	0x17	0x411118	0x1c658	0x1b858	-
VariantClear	0x9	0x41111c	0x1c65c	0x1b85c	-
VariantInit	0x8	0x411120	0x1c660	0x1b860	-
SafeArrayDestroy	0x10	0x411124	0x1c664	0x1b864	-

Remarks

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After