62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a

Analysis

max time kernel
52s
max time network
55s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
Size

72KB
MD5

6de0ae4f822393e9181f2b9367efa318
SHA1

27e6e0bafaa8176566cd3f88c79383eca2310a8b
SHA256

62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a
SHA512

32bb3470fe712dcc9db9d25acc69d3b916e0b53fc06f39f874ea25e58da9fc917ae671a06fe4314ec73de273e437e8c41fcae6a6634bdd845fd7acb7e649f3b0
SSDEEP

768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr9m:teThavEjDWguK9m

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 54 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Executes dropped EXE 64 IoCs

pid	Process
820	update.exe
944	update.exe
1220	backup.exe
1728	System Restore.exe
1724	backup.exe
980	data.exe
1068	backup.exe
684	backup.exe
1856	backup.exe
672	backup.exe
1868	backup.exe
1628	backup.exe
436	backup.exe
1224	backup.exe
1968	System Restore.exe
1372	backup.exe
996	update.exe
1620	backup.exe
320	backup.exe
1296	backup.exe
1708	backup.exe
1176	backup.exe
1764	backup.exe
1724	backup.exe
1636	backup.exe
1552	backup.exe
1360	backup.exe
1056	backup.exe
1520	backup.exe
2028	backup.exe
2032	backup.exe
672	backup.exe
736	backup.exe
1888	backup.exe
1592	backup.exe
1336	backup.exe
1824	backup.exe
1816	backup.exe
1100	backup.exe
1812	backup.exe
1172	backup.exe
988	backup.exe
1912	data.exe
1760	backup.exe
368	backup.exe
944	backup.exe
1756	backup.exe
748	backup.exe
2044	backup.exe
1568	backup.exe
1652	backup.exe
624	backup.exe
1552	backup.exe
1660	backup.exe
1640	backup.exe
2008	backup.exe
2032	backup.exe
672	backup.exe
1944	backup.exe
960	backup.exe
1592	backup.exe
108	backup.exe
1824	backup.exe
1628	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
820	update.exe
820	update.exe
820	update.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
944	update.exe
944	update.exe
944	update.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
980	data.exe
980	data.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
684	backup.exe
684	backup.exe
684	backup.exe
684	backup.exe
684	backup.exe
672	backup.exe
672	backup.exe
672	backup.exe
980	data.exe
980	data.exe
1868	backup.exe
1868	backup.exe
1868	backup.exe
1868	backup.exe
1868	backup.exe
1628	backup.exe
1628	backup.exe
1628	backup.exe
1628	backup.exe
1628	backup.exe
436	backup.exe
436	backup.exe
436	backup.exe
1868	backup.exe
1868	backup.exe
1224	backup.exe
1224	backup.exe
1224	backup.exe
1224	backup.exe
1224	backup.exe
1968	System Restore.exe
1968	System Restore.exe
1968	System Restore.exe
1968	System Restore.exe
1968	System Restore.exe
1372	backup.exe
1372	backup.exe
1372	backup.exe
1968	System Restore.exe
996	update.exe
996	update.exe
996	update.exe
996	update.exe
996	update.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	data.exe
File opened for modification	C:\Program Files\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\System\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe	update.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\backup.exe	data.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Services\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\data.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	data.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\update.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\backup.exe	data.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\System\ado\backup.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System Restore.exe	data.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe

Suspicious use of SetWindowsHookEx 60 IoCs

pid	Process
1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
820	update.exe
944	update.exe
1220	backup.exe
1728	System Restore.exe
1724	backup.exe
980	data.exe
1068	backup.exe
684	backup.exe
1856	backup.exe
672	backup.exe
1868	backup.exe
1628	backup.exe
436	backup.exe
1224	backup.exe
1968	System Restore.exe
1372	backup.exe
996	update.exe
1620	backup.exe
320	backup.exe
1296	backup.exe
1708	backup.exe
1176	backup.exe
1764	backup.exe
1724	backup.exe
1636	backup.exe
1552	backup.exe
1360	backup.exe
1056	backup.exe
1520	backup.exe
2028	backup.exe
2032	backup.exe
672	backup.exe
736	backup.exe
1888	backup.exe
1592	backup.exe
1336	backup.exe
1824	backup.exe
1816	backup.exe
1100	backup.exe
1812	backup.exe
988	backup.exe
1172	backup.exe
1912	data.exe
1760	backup.exe
368	backup.exe
944	backup.exe
1756	backup.exe
748	backup.exe
1568	backup.exe
1552	backup.exe
1660	backup.exe
1640	backup.exe
2008	backup.exe
2032	backup.exe
672	backup.exe
1944	backup.exe
960	backup.exe
1592	backup.exe
108	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 820	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	26
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 944	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	27
PID 1376 wrote to memory of 1220	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	28
PID 1376 wrote to memory of 1220	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	28
PID 1376 wrote to memory of 1220	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	28
PID 1376 wrote to memory of 1220	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	28
PID 1376 wrote to memory of 1728	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	29
PID 1376 wrote to memory of 1728	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	29
PID 1376 wrote to memory of 1728	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	29
PID 1376 wrote to memory of 1728	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	29
PID 1376 wrote to memory of 1724	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	30
PID 1376 wrote to memory of 1724	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	30
PID 1376 wrote to memory of 1724	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	30
PID 1376 wrote to memory of 1724	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	30
PID 820 wrote to memory of 980	820	update.exe	31
PID 820 wrote to memory of 980	820	update.exe	31
PID 820 wrote to memory of 980	820	update.exe	31
PID 820 wrote to memory of 980	820	update.exe	31
PID 820 wrote to memory of 980	820	update.exe	31
PID 820 wrote to memory of 980	820	update.exe	31
PID 820 wrote to memory of 980	820	update.exe	31
PID 1376 wrote to memory of 1068	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	32
PID 1376 wrote to memory of 1068	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	32
PID 1376 wrote to memory of 1068	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	32
PID 1376 wrote to memory of 1068	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	32
PID 980 wrote to memory of 684	980	data.exe	34
PID 980 wrote to memory of 684	980	data.exe	34
PID 980 wrote to memory of 684	980	data.exe	34
PID 980 wrote to memory of 684	980	data.exe	34
PID 980 wrote to memory of 684	980	data.exe	34
PID 980 wrote to memory of 684	980	data.exe	34
PID 980 wrote to memory of 684	980	data.exe	34
PID 1376 wrote to memory of 1856	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	33
PID 1376 wrote to memory of 1856	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	33
PID 1376 wrote to memory of 1856	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	33
PID 1376 wrote to memory of 1856	1376	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe	33
PID 684 wrote to memory of 672	684	backup.exe	35
PID 684 wrote to memory of 672	684	backup.exe	35
PID 684 wrote to memory of 672	684	backup.exe	35
PID 684 wrote to memory of 672	684	backup.exe	35
PID 684 wrote to memory of 672	684	backup.exe	35
PID 684 wrote to memory of 672	684	backup.exe	35
PID 684 wrote to memory of 672	684	backup.exe	35
PID 980 wrote to memory of 1868	980	data.exe	36
PID 980 wrote to memory of 1868	980	data.exe	36
PID 980 wrote to memory of 1868	980	data.exe	36
PID 980 wrote to memory of 1868	980	data.exe	36
PID 980 wrote to memory of 1868	980	data.exe	36
PID 980 wrote to memory of 1868	980	data.exe	36
PID 980 wrote to memory of 1868	980	data.exe	36
PID 1868 wrote to memory of 1628	1868	backup.exe	37
PID 1868 wrote to memory of 1628	1868	backup.exe	37

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe
"C:\Users\Admin\AppData\Local\Temp\62099d32e19fab8de1e19a1de263a2798c81245362bb2b2ccd18311fd454d72a.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1376
- C:\Users\Admin\AppData\Local\Temp\2647793217\update.exe
  C:\Users\Admin\AppData\Local\Temp\2647793217\update.exe C:\Users\Admin\AppData\Local\Temp\2647793217\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:820
- - C:\data.exe
    \data.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:980
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:672
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1868
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1628
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:436
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1224
      - C:\Program Files\Common Files\Microsoft Shared\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1968
        
        C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1372
        
        C:\Program Files\Common Files\Microsoft Shared\ink\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:996
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1708
        
        C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1176
        
        C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1724
        
        C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1636
        
        C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1552
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1360
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1056
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1520
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2028
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2032
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:672
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:736
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1888
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1592
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1336
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1824
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1816
        
        C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1100
        
        C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1812
        
        C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:988
        
        C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:944
        
        C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
        8⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
        8⤵
        
        PID:1148
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
        8⤵
        
        PID:1616
        
        C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
        8⤵
        
        PID:1412
        
        C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
        8⤵
        
        PID:924
        
        C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
        8⤵
        
        PID:1612
        
        C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
        8⤵
        
        PID:1672
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
        8⤵
        
        PID:1960
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
        8⤵
        
        PID:684
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1760
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
        8⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
        8⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
        8⤵
        
        PID:1768
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
        8⤵
        
        PID:320
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
        8⤵
        
        PID:1924
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
        8⤵
        
        PID:1028
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
        7⤵
        
        PID:1372
        
        C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
        7⤵
        
        PID:1260
        
        C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
        7⤵
        
        PID:1056
        
        C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
        7⤵
        
        PID:892
        
        C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
        7⤵
        
        PID:1016
        
        C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
        7⤵
        
        PID:1640
        
        C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
        7⤵
        
        PID:1568
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:368
      - C:\Program Files\Common Files\SpeechEngines\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1568
        
        C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Program Files\Common Files\System\backup.exe
        
        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        8⤵
        
        PID:1608
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        
        PID:1464
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2032
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:1712
        
        C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        8⤵
        
        PID:1224
        
        C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        8⤵
        
        PID:436
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:1168
        
        C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        
        PID:1064
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        
        PID:1532
        
        C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        7⤵
        
        PID:1996
        
        C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        7⤵
        
        PID:1296
        
        C:\Program Files\Common Files\System\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
        7⤵
        
        PID:660
        
        C:\Program Files\Common Files\System\msadc\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
        7⤵
        
        PID:824
    - - C:\Program Files\DVD Maker\data.exe
        
        "C:\Program Files\DVD Maker\data.exe" C:\Program Files\DVD Maker\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1912
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:748
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1552
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1640
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
      - C:\Program Files\DVD Maker\it-IT\backup.exe
        
        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:108
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        
        PID:1812
      - C:\Program Files\DVD Maker\Shared\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        
        PID:1764
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        
        PID:1356
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        
        PID:1328
    - - C:\Program Files\Microsoft Games\System Restore.exe
        
        "C:\Program Files\Microsoft Games\System Restore.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:2004
    - - C:\Program Files\Microsoft Office\backup.exe
        
        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
        5⤵
        
        PID:1456
    - - C:\Program Files\Mozilla Firefox\backup.exe
        
        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
        5⤵
        
        PID:2036
    - - C:\Program Files\MSBuild\System Restore.exe
        
        "C:\Program Files\MSBuild\System Restore.exe" C:\Program Files\MSBuild\
        5⤵
        
        PID:616
    - - C:\Program Files\Reference Assemblies\data.exe
        
        "C:\Program Files\Reference Assemblies\data.exe" C:\Program Files\Reference Assemblies\
        5⤵
        
        PID:2000
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1172
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1756
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Executes dropped EXE
        
        PID:624
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        Executes dropped EXE
        
        PID:1824
      - C:\Program Files (x86)\Common Files\Adobe\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
        6⤵
        
        PID:1552
      - C:\Program Files (x86)\Common Files\Adobe AIR\System Restore.exe
        
        "C:\Program Files (x86)\Common Files\Adobe AIR\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
        6⤵
        
        PID:1000
      - C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
        
        "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
        6⤵
        
        PID:1704
      - C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
        6⤵
        
        PID:2020
      - C:\Program Files (x86)\Common Files\Services\backup.exe
        
        "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
        6⤵
        
        PID:1468
      - C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
        
        "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
        6⤵
        
        PID:524
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        
        PID:1648
    - - C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
        5⤵
        
        PID:1576
    - - C:\Program Files (x86)\Microsoft Office\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
        5⤵
        
        PID:948
    - - C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
        
        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
        5⤵
        
        PID:296
    - - C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
        
        "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
        5⤵
        
        PID:1400
    - - C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
        5⤵
        
        PID:1644
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:960
  - - C:\Windows\System Restore.exe
      "C:\Windows\System Restore.exe" C:\Windows\
      4⤵
      PID:1100
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:944
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\2647793217\update.exe

Filesize
72KB

MD5
5029dc117f6947457de239771294df2b

SHA1
fb6d0e7dd9f5e5b86e2f2f4d53b70f8ad9842b0c

SHA256
3f301fed2a85eae1c6a1d6dbbf400f99ea3a6bca31a76570d363a6430cb1b10b

SHA512
4ef68c8d7dc7f882f0eae6d01ea1ba4751cea913a00139dcfaf575fa77a13ca82d30ab260a6e82fef32075d40f153353edc6200c7066863d524793bf039489bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\2647793217\update.exe

Filesize
72KB

MD5
5029dc117f6947457de239771294df2b

SHA1
fb6d0e7dd9f5e5b86e2f2f4d53b70f8ad9842b0c

SHA256
3f301fed2a85eae1c6a1d6dbbf400f99ea3a6bca31a76570d363a6430cb1b10b

SHA512
4ef68c8d7dc7f882f0eae6d01ea1ba4751cea913a00139dcfaf575fa77a13ca82d30ab260a6e82fef32075d40f153353edc6200c7066863d524793bf039489bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
ab156987b9ff0dee6550d5319f8aebbc

SHA1
1739e8da9f653be8df7f95e6035a3a22dc699931

SHA256
cf23744ffd11359a6eaf060c6a5e63415db5d269ae3ccbb1e0b1970859fefd7b

SHA512
634d6ff74186c6f37ce257cfbcd5b30db01330b7b1be82116620fc81a6a549f315e4e9dd67e926976a07f1e9665ce7cb4c8bbc89b0d2593018dae18bf615cc9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
ab156987b9ff0dee6550d5319f8aebbc

SHA1
1739e8da9f653be8df7f95e6035a3a22dc699931

SHA256
cf23744ffd11359a6eaf060c6a5e63415db5d269ae3ccbb1e0b1970859fefd7b

SHA512
634d6ff74186c6f37ce257cfbcd5b30db01330b7b1be82116620fc81a6a549f315e4e9dd67e926976a07f1e9665ce7cb4c8bbc89b0d2593018dae18bf615cc9c

Download Submit
C:\data.exe

Filesize
72KB

MD5
4b503efe181c857cea1553f158066f4b

SHA1
87957b722d3b6a8b4425d8c2fb75547d5202aa42

SHA256
0edf656a247b996118b0ebb82d7f130efd12dc01451a953ef6cad965e2f56b48

SHA512
1a4c0fb8b551fab98b2823ea6bb5b6b5291d9db90c98a7ad8f6a63b3f49ae156cd1c08140108540eb3942e8fb214b988b98f08b0499c60e8059f346134bdfab7

Download Submit
C:\data.exe

Filesize
72KB

MD5
4b503efe181c857cea1553f158066f4b

SHA1
87957b722d3b6a8b4425d8c2fb75547d5202aa42

SHA256
0edf656a247b996118b0ebb82d7f130efd12dc01451a953ef6cad965e2f56b48

SHA512
1a4c0fb8b551fab98b2823ea6bb5b6b5291d9db90c98a7ad8f6a63b3f49ae156cd1c08140108540eb3942e8fb214b988b98f08b0499c60e8059f346134bdfab7

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
e8323ece5393e8fc87f3923c57de88e2

SHA1
6ae83659c715db5916aa7c94dc88998e04077c14

SHA256
bee3daafc93112208a21f1dd8a3b60f7508f53e42b9bcf1f201f139ae953b659

SHA512
a9fe99456c273ba807c34df02287897fa209a7d7c406d26f23fb718bff0b58fecd3f6262a93d13d6e9505997c3e7f3599645801c2f6237256aaa75c28d88ae72

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
255ce8cb553c0979ebe88455216fac0b

SHA1
60a1ccfa6494994343791109abdd84a4a48e3d55

SHA256
a5ea4f08e1263464a14bcb86fd1e45d44a61869023ae6d4cd427f3aba9fa547d

SHA512
448aab996e079e59dbadf9668d5afdb2b728c69855608aa88b86e73ddaeb2802a9845d1993f55791760c273d76995e13dc2ec9a681a601a9159366230c54d659

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
e5d80588cbca1b57310baf1adbb68deb

SHA1
44e76f152487e91e193ed4aaf21528a4e00c82c5

SHA256
6cbc5f1dca272a5c0a65d09404f4225362a52331585a5503a4f9fe2ff63f6b6b

SHA512
89a88df50d13403ff2c657947fe97692d2a20ea3abe3877b172cf69f45ef4724800b6dc770ed060fdc69e5792c106ec282e9c58c1118f42f2cbff0333b244cbd

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
729637ea1a81356706342895dd426045

SHA1
33c0d65c59f4ae69f78ded124e0b50cdfa6d0265

SHA256
4073dbd9c810c76c8330b17eb9e565715f227e03b817d5852cbe2e88012aad29

SHA512
ed5b89a45d469cf1e6319a1730636d1ce3ab72a41093ca3ec86836f0a66edff77433a983a4309c4ee55920e73e07ce1752ab468c1c9b7dff3435e82f1b4b89ca

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
15d8c094c463f505024a402da55a9de8

SHA1
4c17a3cf0917971bb5885052ab242ec7aa9277e7

SHA256
fba7538f112635d09aac0dff149deb40cfe142f159a2be47bf82a4705a44720f

SHA512
654fc08c0a38dec9ef893024c0c3e2b5de93f58ca6165764edb6eae033a2eb66d3138fa5ad5f936e112b3257cd560a1c023cc07568eed763658361f9ec671a55

Download Submit
\Users\Admin\AppData\Local\Temp\2647793217\update.exe

Filesize
72KB

MD5
5029dc117f6947457de239771294df2b

SHA1
fb6d0e7dd9f5e5b86e2f2f4d53b70f8ad9842b0c

SHA256
3f301fed2a85eae1c6a1d6dbbf400f99ea3a6bca31a76570d363a6430cb1b10b

SHA512
4ef68c8d7dc7f882f0eae6d01ea1ba4751cea913a00139dcfaf575fa77a13ca82d30ab260a6e82fef32075d40f153353edc6200c7066863d524793bf039489bc

Download Submit
\Users\Admin\AppData\Local\Temp\2647793217\update.exe

Filesize
72KB

MD5
5029dc117f6947457de239771294df2b

SHA1
fb6d0e7dd9f5e5b86e2f2f4d53b70f8ad9842b0c

SHA256
3f301fed2a85eae1c6a1d6dbbf400f99ea3a6bca31a76570d363a6430cb1b10b

SHA512
4ef68c8d7dc7f882f0eae6d01ea1ba4751cea913a00139dcfaf575fa77a13ca82d30ab260a6e82fef32075d40f153353edc6200c7066863d524793bf039489bc

Download Submit
\Users\Admin\AppData\Local\Temp\2647793217\update.exe

Filesize
72KB

MD5
5029dc117f6947457de239771294df2b

SHA1
fb6d0e7dd9f5e5b86e2f2f4d53b70f8ad9842b0c

SHA256
3f301fed2a85eae1c6a1d6dbbf400f99ea3a6bca31a76570d363a6430cb1b10b

SHA512
4ef68c8d7dc7f882f0eae6d01ea1ba4751cea913a00139dcfaf575fa77a13ca82d30ab260a6e82fef32075d40f153353edc6200c7066863d524793bf039489bc

Download Submit
\Users\Admin\AppData\Local\Temp\2647793217\update.exe

Filesize
72KB

MD5
5029dc117f6947457de239771294df2b

SHA1
fb6d0e7dd9f5e5b86e2f2f4d53b70f8ad9842b0c

SHA256
3f301fed2a85eae1c6a1d6dbbf400f99ea3a6bca31a76570d363a6430cb1b10b

SHA512
4ef68c8d7dc7f882f0eae6d01ea1ba4751cea913a00139dcfaf575fa77a13ca82d30ab260a6e82fef32075d40f153353edc6200c7066863d524793bf039489bc

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
ab156987b9ff0dee6550d5319f8aebbc

SHA1
1739e8da9f653be8df7f95e6035a3a22dc699931

SHA256
cf23744ffd11359a6eaf060c6a5e63415db5d269ae3ccbb1e0b1970859fefd7b

SHA512
634d6ff74186c6f37ce257cfbcd5b30db01330b7b1be82116620fc81a6a549f315e4e9dd67e926976a07f1e9665ce7cb4c8bbc89b0d2593018dae18bf615cc9c

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
ab156987b9ff0dee6550d5319f8aebbc

SHA1
1739e8da9f653be8df7f95e6035a3a22dc699931

SHA256
cf23744ffd11359a6eaf060c6a5e63415db5d269ae3ccbb1e0b1970859fefd7b

SHA512
634d6ff74186c6f37ce257cfbcd5b30db01330b7b1be82116620fc81a6a549f315e4e9dd67e926976a07f1e9665ce7cb4c8bbc89b0d2593018dae18bf615cc9c

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe

Filesize
72KB

MD5
ee0e8e7e0506b9e2bfba61ca0c2c7785

SHA1
9df894cfa64f0dc12f8defeec210da323fe78f1e

SHA256
d9f4cde7a49d38b8baecf61ebdd3161e1f4c4feef6fec1bd14067bd783a65d0c

SHA512
c3d4c358072f76aec224a838136148e4ef2e3f5eed6ab40105d2dfe57a36e4ce2ca6927c327afc274f0ae4b45b3a807704ca1ed969709d60662902684c1c7bf6

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
ab156987b9ff0dee6550d5319f8aebbc

SHA1
1739e8da9f653be8df7f95e6035a3a22dc699931

SHA256
cf23744ffd11359a6eaf060c6a5e63415db5d269ae3ccbb1e0b1970859fefd7b

SHA512
634d6ff74186c6f37ce257cfbcd5b30db01330b7b1be82116620fc81a6a549f315e4e9dd67e926976a07f1e9665ce7cb4c8bbc89b0d2593018dae18bf615cc9c

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
ab156987b9ff0dee6550d5319f8aebbc

SHA1
1739e8da9f653be8df7f95e6035a3a22dc699931

SHA256
cf23744ffd11359a6eaf060c6a5e63415db5d269ae3ccbb1e0b1970859fefd7b

SHA512
634d6ff74186c6f37ce257cfbcd5b30db01330b7b1be82116620fc81a6a549f315e4e9dd67e926976a07f1e9665ce7cb4c8bbc89b0d2593018dae18bf615cc9c

Download Submit
memory/820-60-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-176-0x0000000074291000-0x0000000074293000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads