5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59

Analysis

max time kernel
100s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
Size

72KB
MD5

5fca8bb3e308f03727acf4a9e5d59502
SHA1

cd42f7a4f7b7f4e971cf45f809740ec79e913a99
SHA256

5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59
SHA512

befc7bf9081b073dfd40bc8c5b3e86333697d6b2fdd794fb1d76dac26cb376f4653afcc0a260e9939c9070ed826b86158e8afa4ed064ca81d1d03b76990a4b88
SSDEEP

768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr3k7w:teThavEjDWguKU7w

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Executes dropped EXE 64 IoCs

pid	Process
1912	backup.exe
1596	backup.exe
628	backup.exe
1420	backup.exe
956	backup.exe
700	backup.exe
1188	backup.exe
1892	backup.exe
968	update.exe
776	backup.exe
1752	backup.exe
1624	backup.exe
1516	backup.exe
1332	backup.exe
344	backup.exe
1848	backup.exe
2012	backup.exe
1756	backup.exe
1560	backup.exe
1708	backup.exe
992	backup.exe
956	update.exe
700	backup.exe
580	backup.exe
1188	backup.exe
1164	backup.exe
1984	backup.exe
308	backup.exe
972	backup.exe
688	System Restore.exe
796	backup.exe
2044	backup.exe
436	backup.exe
976	backup.exe
1036	backup.exe
1480	backup.exe
1712	update.exe
544	backup.exe
564	backup.exe
1304	backup.exe
1204	backup.exe
1944	backup.exe
1580	backup.exe
1564	backup.exe
1280	backup.exe
1532	backup.exe
1372	backup.exe
1420	backup.exe
1668	backup.exe
956	backup.exe
560	update.exe
284	backup.exe
1644	backup.exe
1116	backup.exe
280	data.exe
1244	backup.exe
1576	backup.exe
1120	System Restore.exe
1620	backup.exe
812	backup.exe
1404	backup.exe
1036	backup.exe
1480	backup.exe
1812	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1892	backup.exe
968	update.exe
968	update.exe
968	update.exe
968	update.exe
968	update.exe
776	backup.exe
776	backup.exe
776	backup.exe
1892	backup.exe
1892	backup.exe
1752	backup.exe
1752	backup.exe
1624	backup.exe
1624	backup.exe
1752	backup.exe
1752	backup.exe
1332	backup.exe
1332	backup.exe
344	backup.exe
344	backup.exe
344	backup.exe
344	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
956	update.exe
956	update.exe
956	update.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
2012	backup.exe
972	backup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\data.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\data.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
1912	backup.exe
1596	backup.exe
628	backup.exe
1420	backup.exe
956	backup.exe
700	backup.exe
1188	backup.exe
1892	backup.exe
968	update.exe
776	backup.exe
1752	backup.exe
1624	backup.exe
1516	backup.exe
1332	backup.exe
344	backup.exe
1848	backup.exe
2012	backup.exe
1756	backup.exe
1560	backup.exe
1708	backup.exe
992	backup.exe
956	update.exe
700	backup.exe
580	backup.exe
1188	backup.exe
1164	backup.exe
1984	backup.exe
308	backup.exe
972	backup.exe
688	System Restore.exe
796	backup.exe
2044	backup.exe
436	backup.exe
976	backup.exe
1036	backup.exe
1480	backup.exe
1712	update.exe
544	backup.exe
564	backup.exe
1304	backup.exe
1204	backup.exe
1944	backup.exe
1580	backup.exe
1564	backup.exe
1280	backup.exe
1532	backup.exe
1372	backup.exe
1420	backup.exe
1668	backup.exe
956	backup.exe
560	update.exe
284	backup.exe
1644	backup.exe
1116	backup.exe
280	data.exe
1244	backup.exe
1576	backup.exe
1120	System Restore.exe
812	backup.exe
1620	backup.exe
1404	backup.exe
1036	backup.exe
1480	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1912	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	28
PID 1112 wrote to memory of 1912	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	28
PID 1112 wrote to memory of 1912	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	28
PID 1112 wrote to memory of 1912	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	28
PID 1112 wrote to memory of 1596	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	29
PID 1112 wrote to memory of 1596	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	29
PID 1112 wrote to memory of 1596	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	29
PID 1112 wrote to memory of 1596	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	29
PID 1112 wrote to memory of 628	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	30
PID 1112 wrote to memory of 628	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	30
PID 1112 wrote to memory of 628	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	30
PID 1112 wrote to memory of 628	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	30
PID 1112 wrote to memory of 1420	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	31
PID 1112 wrote to memory of 1420	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	31
PID 1112 wrote to memory of 1420	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	31
PID 1112 wrote to memory of 1420	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	31
PID 1112 wrote to memory of 956	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	33
PID 1112 wrote to memory of 956	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	33
PID 1112 wrote to memory of 956	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	33
PID 1112 wrote to memory of 956	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	33
PID 1112 wrote to memory of 700	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	32
PID 1112 wrote to memory of 700	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	32
PID 1112 wrote to memory of 700	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	32
PID 1112 wrote to memory of 700	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	32
PID 1112 wrote to memory of 1188	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	34
PID 1112 wrote to memory of 1188	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	34
PID 1112 wrote to memory of 1188	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	34
PID 1112 wrote to memory of 1188	1112	5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe	34
PID 1912 wrote to memory of 1892	1912	backup.exe	35
PID 1912 wrote to memory of 1892	1912	backup.exe	35
PID 1912 wrote to memory of 1892	1912	backup.exe	35
PID 1912 wrote to memory of 1892	1912	backup.exe	35
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 1892 wrote to memory of 968	1892	backup.exe	36
PID 968 wrote to memory of 776	968	update.exe	37
PID 968 wrote to memory of 776	968	update.exe	37
PID 968 wrote to memory of 776	968	update.exe	37
PID 968 wrote to memory of 776	968	update.exe	37
PID 968 wrote to memory of 776	968	update.exe	37
PID 968 wrote to memory of 776	968	update.exe	37
PID 968 wrote to memory of 776	968	update.exe	37
PID 1892 wrote to memory of 1752	1892	backup.exe	38
PID 1892 wrote to memory of 1752	1892	backup.exe	38
PID 1892 wrote to memory of 1752	1892	backup.exe	38
PID 1892 wrote to memory of 1752	1892	backup.exe	38
PID 1752 wrote to memory of 1624	1752	backup.exe	39
PID 1752 wrote to memory of 1624	1752	backup.exe	39
PID 1752 wrote to memory of 1624	1752	backup.exe	39
PID 1752 wrote to memory of 1624	1752	backup.exe	39
PID 1624 wrote to memory of 1516	1624	backup.exe	40
PID 1624 wrote to memory of 1516	1624	backup.exe	40
PID 1624 wrote to memory of 1516	1624	backup.exe	40
PID 1624 wrote to memory of 1516	1624	backup.exe	40
PID 1752 wrote to memory of 1332	1752	backup.exe	41
PID 1752 wrote to memory of 1332	1752	backup.exe	41
PID 1752 wrote to memory of 1332	1752	backup.exe	41
PID 1752 wrote to memory of 1332	1752	backup.exe	41
PID 1332 wrote to memory of 344	1332	backup.exe	42
PID 1332 wrote to memory of 344	1332	backup.exe	42

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe

C:\Users\Admin\AppData\Local\Temp\5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe
"C:\Users\Admin\AppData\Local\Temp\5d539571200cbdb657ba4ad8e9d252cfdc330f094eb87ff9c3635d9020289a59.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\628908108\backup.exe
  C:\Users\Admin\AppData\Local\Temp\628908108\backup.exe C:\Users\Admin\AppData\Local\Temp\628908108\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1912
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\PerfLogs\update.exe
      C:\PerfLogs\update.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:968
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:776
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1624
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1516
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1332
      - C:\Program Files\Common Files\Microsoft Shared\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:344
        
        C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1848
        
        C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1756
        
        C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1560
        
        C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1708
        
        C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:992
        
        C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:956
        
        C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:700
        
        C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:580
        
        C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1188
        
        C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1984
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:308
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:972
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:688
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:796
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:436
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:976
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1480
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1712
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
        
        C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
        
        C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
        
        C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1564
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1280
        
        C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1532
        
        C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
        
        C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1420
        
        C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:284
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1116
        
        C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\data.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:280
        
        C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1120
        
        C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1036
        
        C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
        8⤵
        
        PID:576
        
        C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1728
        
        C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
        8⤵
        System policy modification
        
        PID:1280
        
        C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1420
        
        C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
        8⤵
        System policy modification
        
        PID:1164
        
        C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1660
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:812
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1040
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:2032
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
        8⤵
        System policy modification
        
        PID:1708
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1668
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
        8⤵
        
        PID:880
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
        8⤵
        
        PID:1524
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        7⤵
        
        PID:1968
        
        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
        7⤵
        
        PID:964
        
        C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
        7⤵
        
        PID:1736
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1620
      - C:\Program Files\Common Files\SpeechEngines\data.exe
        
        "C:\Program Files\Common Files\SpeechEngines\data.exe" C:\Program Files\Common Files\SpeechEngines\
        6⤵
        Drops file in Program Files directory
        System policy modification
        
        PID:1380
        
        C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
        7⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1680
      - C:\Program Files\Common Files\System\backup.exe
        
        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
        6⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Program Files directory
        
        PID:1792
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        Drops file in Program Files directory
        System policy modification
        
        PID:904
        
        C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        8⤵
        
        PID:1984
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        
        PID:1612
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        
        PID:1120
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:1580
        
        C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        8⤵
        
        PID:1280
        
        C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        8⤵
        
        PID:1512
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:1080
        
        C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        
        PID:1628
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        
        PID:980
        
        C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        7⤵
        
        PID:1276
        
        C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        7⤵
        
        PID:284
    - - C:\Program Files\DVD Maker\backup.exe
        
        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1480
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:564
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1424
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        
        PID:364
      - C:\Program Files\DVD Maker\it-IT\backup.exe
        
        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        
        PID:976
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        
        PID:2032
      - C:\Program Files\DVD Maker\Shared\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        
        PID:1768
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        
        PID:1996
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        
        PID:1304
      - C:\Program Files\Internet Explorer\de-DE\backup.exe
        
        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
        6⤵
        
        PID:1076
      - C:\Program Files\Internet Explorer\en-US\backup.exe
        
        "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
        6⤵
        
        PID:608
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        
        PID:1664
    - - C:\Program Files\Microsoft Games\backup.exe
        
        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:1520
    - - C:\Program Files\Microsoft Office\backup.exe
        
        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
        5⤵
        
        PID:520
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1244
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1404
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        System policy modification
        
        PID:1812
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:964
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Program Files directory
        
        PID:276
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        
        PID:952
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        
        PID:1640
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        
        PID:1036
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        
        PID:1728
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        
        PID:956
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        8⤵
        
        PID:1616
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        8⤵
        
        PID:1780
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        
        PID:576
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        
        PID:1380
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        
        PID:1712
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        
        PID:1204
      - C:\Program Files (x86)\Google\CrashReports\backup.exe
        
        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
        6⤵
        
        PID:1588
      - C:\Program Files (x86)\Google\Policies\backup.exe
        
        "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
        6⤵
        
        PID:2012
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        
        PID:672
    - - C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft Office\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
        5⤵
        
        PID:1516
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      PID:1248
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        
        PID:1420
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        
        PID:1504
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      PID:556
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:628
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:700
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:956
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
C:\PerfLogs\update.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
C:\PerfLogs\update.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
C:\Users\Admin\AppData\Local\Temp\628908108\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\Users\Admin\AppData\Local\Temp\628908108\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
0559214f85d2b9959f7dee64979104b8

SHA1
4b1e0e4002a8558b327f7ef865e2de532374124f

SHA256
6cb002c91d88f23715108ad721d40fe9fc78d00123d6ebc7dd48bdfc0df791ec

SHA512
fb95619cfca8d08c2546a83f92d5927baf2dd9f811a15290fab50c0cd122948b2e772b4e39f8ec464d70d99ec6e8b9d42aaa1eee4740508ea109c26b4e5eb582

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
C:\backup.exe

Filesize
72KB

MD5
599f33aa22f7a840e8e946adcac90e14

SHA1
659c466909261d70d6a68f6fb4971014ffa68c70

SHA256
eb7377f8ca702f96a647b0b908914c4c9b20241577adac117ae38a977b104c6b

SHA512
e761c619bcb94ada5250435083dd616e1d4528d8fe1c862bbfb28d1119cf8cf5c2b31262e65a937cc1edd29d7c8b43da754b081eb1be45d465aee90e216cec54

Download Submit
C:\backup.exe

Filesize
72KB

MD5
599f33aa22f7a840e8e946adcac90e14

SHA1
659c466909261d70d6a68f6fb4971014ffa68c70

SHA256
eb7377f8ca702f96a647b0b908914c4c9b20241577adac117ae38a977b104c6b

SHA512
e761c619bcb94ada5250435083dd616e1d4528d8fe1c862bbfb28d1119cf8cf5c2b31262e65a937cc1edd29d7c8b43da754b081eb1be45d465aee90e216cec54

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
1e1e6c3f0121619fc6a401298a090326

SHA1
9e447dd6976746289b26d53651b8c68cc87f97a6

SHA256
2d2044afde4d729a07faaa31e7ac3771d200444fe1309d517e8d62134d477d34

SHA512
eb130091813e79754aff8f49464410964a7613446c9a501fc79d2455130cd422c304398d0326515f6c0238d60f0fbd0bc761db66de0b87293ecdc2aa893c4b80

Download Submit
\PerfLogs\update.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
\PerfLogs\update.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
\PerfLogs\update.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
\PerfLogs\update.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
c8b240148d098a8326f6aa8a03375723

SHA1
23a41c9fbe5b774a20b18935cc6dbb4fad5ca7d4

SHA256
4d4ddbf282171e3d06efdefdf78bb264aa4cc69673a936e726062b654db761c1

SHA512
4e7a0ec2c0c067b7809b301e71a3b730a7061546fec671f4f16b853fa2458e80a3cd5ed8e8b0eecfef3ba74b6fd9bcf0d642dad1659f28324e1341e813235d8b

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
72KB

MD5
1d2d0cfe2aedfc4c5e1570b7f7c6ec65

SHA1
b836a892953c85836dcfc453219de91b4ad62a41

SHA256
8f1a98035063e6a28cc749abdb690d3add3cd86dd9280b25f19b31d98fd5d19e

SHA512
f00e4e07dd7c82040c5a2d52dc00d76ba159bcd50ed134ac76297e11e9c56a505613bef55fc16b904c882ca69d5c9b71db381bbf4d03d4a716ccc1a110c75d7b

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
4de0b020a39ad648d706141d7f980321

SHA1
4797eb7bd45e5f9596c7217a70b418d99dfda4c2

SHA256
ead399eb95b6d2331d71639ac3872c112d45b8280a3493fdc1fa470a38b72122

SHA512
e6c9c466b81037c6fdc92dc48b1c246f5cef5c065dac63f2be5769fd04d07fb0ea158aec8085d3eb54f90eb9a870ba72a5f9a296127c6c49ab897376b1a13959

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
f7a860970e1878769ec12247aa489fe3

SHA1
0f681098244396ac8fc3a6458fa804a5ced79c70

SHA256
dafceae36c63ae3ba6a9fabb539769a35ce22fc4ca4608c12bf6a2351a2f4a3b

SHA512
44597bb1952911c7a5ac1fc27279ab14983ec856aabb9ab2101aeeb6b0282d05a181fc3df7cf0800d90066c38d28c5e51a738cc34882e99de2927726e90b35b3

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
fc551c0cbb5d88d03f66d64b6d60392b

SHA1
f9561d7c7b9693e6a5fcf71f429fc49082555880

SHA256
bbb38022c27e7cf31682ee560b0516be83fc1f633d6553a9151cab47c9d7fb78

SHA512
1838d09b88c034949ad426998d4d4e07d0f7bb32f523fcb2cfaea0c11e41c64aec346a923c8ed2420a3cafc7066cdc97b82bf129389994d25c9777d06fccf450

Download Submit
\Users\Admin\AppData\Local\Temp\628908108\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\628908108\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
0559214f85d2b9959f7dee64979104b8

SHA1
4b1e0e4002a8558b327f7ef865e2de532374124f

SHA256
6cb002c91d88f23715108ad721d40fe9fc78d00123d6ebc7dd48bdfc0df791ec

SHA512
fb95619cfca8d08c2546a83f92d5927baf2dd9f811a15290fab50c0cd122948b2e772b4e39f8ec464d70d99ec6e8b9d42aaa1eee4740508ea109c26b4e5eb582

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
0559214f85d2b9959f7dee64979104b8

SHA1
4b1e0e4002a8558b327f7ef865e2de532374124f

SHA256
6cb002c91d88f23715108ad721d40fe9fc78d00123d6ebc7dd48bdfc0df791ec

SHA512
fb95619cfca8d08c2546a83f92d5927baf2dd9f811a15290fab50c0cd122948b2e772b4e39f8ec464d70d99ec6e8b9d42aaa1eee4740508ea109c26b4e5eb582

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
8e56c0ec43849838ecf8340d54b3c4be

SHA1
404c659a04e7e45d2fbec4fb994513e7f4861e1c

SHA256
6279e2d797e40ec7168b78872fdfb16a3adb35278e7b113a8f7ba90c58f926f4

SHA512
0f564a9a35d7c6173886914af371c8d7d896cd6d95f4cd773194304688202501fee8494f791cf58dfd6511c8a950dbd7be68700542f57b571b5dab594cb9896a

Download Submit
memory/1112-100-0x00000000741C1000-0x00000000741C3000-memory.dmp

Filesize
8KB

Download
memory/1112-98-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads