Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe
Resource
win10v2004-20220812-en
General
-
Target
a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe
-
Size
72KB
-
MD5
7cb86968eb41305b36013a5497112d6a
-
SHA1
3ad267df4ba43d9c1f5d07205909c003ad156103
-
SHA256
a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d
-
SHA512
fa43a248bef03b6dfa5f01d8187bd82e46a92303fe10d88a1b6359c64964ad06c1e12149652bec1aa32dcdda0f15a14812cdb5f5f9252ff1caf3a04f40b0b02f
-
SSDEEP
768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr3kL9:teThavEjDWguKUL9
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 952 data.exe 1360 backup.exe 1652 backup.exe 432 backup.exe 1704 backup.exe 1512 data.exe 1324 backup.exe 1696 backup.exe 1104 backup.exe 1500 backup.exe 1964 backup.exe 1904 backup.exe 1436 backup.exe 1720 backup.exe 832 backup.exe 1072 backup.exe 1456 backup.exe 1288 backup.exe 276 backup.exe 640 backup.exe 1216 backup.exe 652 backup.exe 1680 backup.exe 984 data.exe 1584 backup.exe 1324 backup.exe 1616 backup.exe 592 backup.exe 860 backup.exe 1108 data.exe 1644 System Restore.exe 1908 backup.exe 872 backup.exe 1752 backup.exe 1544 backup.exe 1932 backup.exe 1740 backup.exe 1904 backup.exe 1924 backup.exe 1196 backup.exe 2032 backup.exe 1228 backup.exe 956 backup.exe 568 backup.exe 764 backup.exe 524 backup.exe 276 backup.exe 1472 backup.exe 432 backup.exe 1832 backup.exe 1528 backup.exe 868 backup.exe 1876 backup.exe 1036 update.exe 1616 backup.exe 592 backup.exe 1972 backup.exe 1784 backup.exe 1976 backup.exe 1948 backup.exe 560 backup.exe 1440 backup.exe 360 backup.exe 1436 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 1696 backup.exe 1696 backup.exe 1104 backup.exe 1104 backup.exe 1696 backup.exe 1696 backup.exe 1964 backup.exe 1964 backup.exe 1904 backup.exe 1904 backup.exe 1964 backup.exe 1964 backup.exe 1720 backup.exe 1720 backup.exe 832 backup.exe 832 backup.exe 832 backup.exe 832 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 1456 backup.exe 860 backup.exe 860 backup.exe 860 backup.exe 860 backup.exe 860 backup.exe 860 backup.exe 860 backup.exe 860 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\data.exe backup.exe File opened for modification C:\Program Files\VideoLAN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\backup.exe data.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe System Restore.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\update.exe backup.exe File opened for modification C:\Program Files\MSBuild\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 952 data.exe 1360 backup.exe 1652 backup.exe 432 backup.exe 1704 backup.exe 1512 data.exe 1324 backup.exe 1696 backup.exe 1104 backup.exe 1500 backup.exe 1964 backup.exe 1904 backup.exe 1436 backup.exe 1720 backup.exe 832 backup.exe 1072 backup.exe 1456 backup.exe 1288 backup.exe 276 backup.exe 640 backup.exe 1216 backup.exe 652 backup.exe 1680 backup.exe 984 data.exe 1584 backup.exe 1324 backup.exe 1616 backup.exe 592 backup.exe 860 backup.exe 1108 data.exe 1644 System Restore.exe 1908 backup.exe 872 backup.exe 1752 backup.exe 1544 backup.exe 1932 backup.exe 1740 backup.exe 1904 backup.exe 1924 backup.exe 1196 backup.exe 2032 backup.exe 1228 backup.exe 956 backup.exe 568 backup.exe 764 backup.exe 524 backup.exe 276 backup.exe 1472 backup.exe 432 backup.exe 1832 backup.exe 1528 backup.exe 868 backup.exe 1876 backup.exe 1036 update.exe 1616 backup.exe 592 backup.exe 1972 backup.exe 1784 backup.exe 1976 backup.exe 1948 backup.exe 560 backup.exe 1440 backup.exe 360 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1168 wrote to memory of 952 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 27 PID 1168 wrote to memory of 952 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 27 PID 1168 wrote to memory of 952 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 27 PID 1168 wrote to memory of 952 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 27 PID 1168 wrote to memory of 1360 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 28 PID 1168 wrote to memory of 1360 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 28 PID 1168 wrote to memory of 1360 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 28 PID 1168 wrote to memory of 1360 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 28 PID 1168 wrote to memory of 1652 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 29 PID 1168 wrote to memory of 1652 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 29 PID 1168 wrote to memory of 1652 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 29 PID 1168 wrote to memory of 1652 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 29 PID 1168 wrote to memory of 432 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 30 PID 1168 wrote to memory of 432 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 30 PID 1168 wrote to memory of 432 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 30 PID 1168 wrote to memory of 432 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 30 PID 1168 wrote to memory of 1704 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 31 PID 1168 wrote to memory of 1704 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 31 PID 1168 wrote to memory of 1704 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 31 PID 1168 wrote to memory of 1704 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 31 PID 1168 wrote to memory of 1512 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 32 PID 1168 wrote to memory of 1512 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 32 PID 1168 wrote to memory of 1512 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 32 PID 1168 wrote to memory of 1512 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 32 PID 1168 wrote to memory of 1324 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 33 PID 1168 wrote to memory of 1324 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 33 PID 1168 wrote to memory of 1324 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 33 PID 1168 wrote to memory of 1324 1168 a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe 33 PID 952 wrote to memory of 1696 952 data.exe 34 PID 952 wrote to memory of 1696 952 data.exe 34 PID 952 wrote to memory of 1696 952 data.exe 34 PID 952 wrote to memory of 1696 952 data.exe 34 PID 1696 wrote to memory of 1104 1696 backup.exe 35 PID 1696 wrote to memory of 1104 1696 backup.exe 35 PID 1696 wrote to memory of 1104 1696 backup.exe 35 PID 1696 wrote to memory of 1104 1696 backup.exe 35 PID 1104 wrote to memory of 1500 1104 backup.exe 36 PID 1104 wrote to memory of 1500 1104 backup.exe 36 PID 1104 wrote to memory of 1500 1104 backup.exe 36 PID 1104 wrote to memory of 1500 1104 backup.exe 36 PID 1696 wrote to memory of 1964 1696 backup.exe 37 PID 1696 wrote to memory of 1964 1696 backup.exe 37 PID 1696 wrote to memory of 1964 1696 backup.exe 37 PID 1696 wrote to memory of 1964 1696 backup.exe 37 PID 1964 wrote to memory of 1904 1964 backup.exe 38 PID 1964 wrote to memory of 1904 1964 backup.exe 38 PID 1964 wrote to memory of 1904 1964 backup.exe 38 PID 1964 wrote to memory of 1904 1964 backup.exe 38 PID 1904 wrote to memory of 1436 1904 backup.exe 39 PID 1904 wrote to memory of 1436 1904 backup.exe 39 PID 1904 wrote to memory of 1436 1904 backup.exe 39 PID 1904 wrote to memory of 1436 1904 backup.exe 39 PID 1964 wrote to memory of 1720 1964 backup.exe 40 PID 1964 wrote to memory of 1720 1964 backup.exe 40 PID 1964 wrote to memory of 1720 1964 backup.exe 40 PID 1964 wrote to memory of 1720 1964 backup.exe 40 PID 1720 wrote to memory of 832 1720 backup.exe 41 PID 1720 wrote to memory of 832 1720 backup.exe 41 PID 1720 wrote to memory of 832 1720 backup.exe 41 PID 1720 wrote to memory of 832 1720 backup.exe 41 PID 832 wrote to memory of 1072 832 backup.exe 42 PID 832 wrote to memory of 1072 832 backup.exe 42 PID 832 wrote to memory of 1072 832 backup.exe 42 PID 832 wrote to memory of 1072 832 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe"C:\Users\Admin\AppData\Local\Temp\a2ef3cc287bc84094d75bff355723bdd4780d5dfaed92c682f7f38b43fd2137d.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\520779533\data.exeC:\Users\Admin\AppData\Local\Temp\520779533\data.exe C:\Users\Admin\AppData\Local\Temp\520779533\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1696 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1104 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1964 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1072
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1456 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:640
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1216
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:860 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:360
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:1436 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵PID:1508
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1244
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:2032
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:2036
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1724
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1488
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1288
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
PID:764 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:676
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1312
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1292
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- System policy modification
PID:652
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1576 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- System policy modification
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- System policy modification
PID:1504
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1080
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- System policy modification
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1784
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:1500
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:268
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:1752
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- System policy modification
PID:796 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1440
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
PID:1208 -
C:\Program Files\Common Files\System\ado\update.exe"C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:892 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1660
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1904
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1244
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- System policy modification
PID:1460
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1996
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:904
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1724
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- System policy modification
PID:568
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1920
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
PID:1360
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- System policy modification
PID:676
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- System policy modification
PID:1480
-
-
C:\Program Files\Common Files\System\msadc\data.exe"C:\Program Files\Common Files\System\msadc\data.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Drops file in Program Files directory
PID:1312 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:1292
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:432
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:652
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:1684
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1892
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:1612
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1088 -
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:1324
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵PID:1396
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:592
-
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵PID:1576
-
-
C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵
- System policy modification
PID:1080
-
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\data.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\data.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\8⤵PID:1896
-
-
-
-
-
C:\Program Files\DVD Maker\update.exe"C:\Program Files\DVD Maker\update.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:1104 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1976
-
-
C:\Program Files\DVD Maker\en-US\update.exe"C:\Program Files\DVD Maker\en-US\update.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:832
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1368
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1440
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1556
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1668
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1904
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:848 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
PID:1996
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
PID:2036
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1144
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1124
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
PID:1028
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1472
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:640
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1436
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:560
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:2036
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:996
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:1768
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:1312
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1684 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- System policy modification
PID:1892 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:1324
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
PID:1108 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- System policy modification
PID:1396
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1896
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Modifies visibility of file extensions in Explorer
PID:780
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
PID:432
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵PID:872
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:652
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1072 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1664
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1292
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1184
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1612
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1660
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:1596
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:1992
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:1744
-
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\5⤵PID:1620
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
PID:1348 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵PID:1992
-
C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:828 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- System policy modification
PID:1740
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1360
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- System policy modification
PID:1216
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1540
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
PID:536
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:1512
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:700
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:984
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:1036
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- System policy modification
PID:1712
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Drops file in Program Files directory
PID:1220 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Drops file in Program Files directory
PID:1084 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:1984
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- System policy modification
PID:1644 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Modifies visibility of file extensions in Explorer
PID:1972
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Drops file in Program Files directory
PID:1900 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵PID:1068
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1784
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- System policy modification
PID:560
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
PID:832
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- System policy modification
PID:988
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:360 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- System policy modification
PID:1648 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1660
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
PID:1668
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- System policy modification
PID:1988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1072
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Modifies visibility of file extensions in Explorer
PID:956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵PID:596
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵
- System policy modification
PID:2036
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:276
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1432 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\10⤵
- Modifies visibility of file extensions in Explorer
PID:996
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\10⤵
- Drops file in Program Files directory
PID:1184 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵
- Modifies visibility of file extensions in Explorer
PID:764
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵PID:868
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\11⤵
- Modifies visibility of file extensions in Explorer
PID:700
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
PID:1768 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- System policy modification
PID:1576
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1928 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1208
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1068
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1784 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\data.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵PID:1756
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵PID:1960
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵PID:568
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1716
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1724
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\data.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵PID:1536
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1528
-
-
C:\Program Files (x86)\Common Files\microsoft shared\System Restore.exe"C:\Program Files (x86)\Common Files\microsoft shared\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1680
-
-
C:\Program Files (x86)\Common Files\Services\data.exe"C:\Program Files (x86)\Common Files\Services\data.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1644
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:1196
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:268
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
PID:892 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1616
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1080
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1936
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1584 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:1576
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵
- System policy modification
PID:1500
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:1508
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:1216
-
-
C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\6⤵PID:1492
-
-
C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\6⤵PID:1684
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1288
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:780
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:796
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\5⤵PID:1488
-
-
-
C:\Users\System Restore.exe"C:\Users\System Restore.exe" C:\Users\4⤵PID:1344
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1808
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:592
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1784
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1244 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1752
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1932
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:588
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1484
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:1368
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:1712
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5219efcc56a6561f6bc144410bf6e28cb
SHA158ec75047897bc0f7bee07d5fb23b29c83be929b
SHA256dad368957227bef299bf460e01e50943410347f6df18f4321c0888585052c463
SHA512173770f2856f627406edd4fcf1750f6763404f1156801821900b9683314e73d7b75d1817776fbe0ce62d113252b4e95a41a3914100aaf4fa89c1b17b628aa046
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD533aecd52463c7c1c8a5c56d8153dc750
SHA1eddda0180f5f0d39e356ec6f5d94151a9fd009df
SHA256d2179ce9d6200d4326448e2c59c006337f2910c73af92a11b816c035ea1f971d
SHA512004afbcec15cff678b720111e2447784ea815c2c693e96e51e03f891559e60484c2fabce59c7b7b585d8647fa02c394d2506ed0b6205ccc58dab7bd4b5106987
-
Filesize
72KB
MD533aecd52463c7c1c8a5c56d8153dc750
SHA1eddda0180f5f0d39e356ec6f5d94151a9fd009df
SHA256d2179ce9d6200d4326448e2c59c006337f2910c73af92a11b816c035ea1f971d
SHA512004afbcec15cff678b720111e2447784ea815c2c693e96e51e03f891559e60484c2fabce59c7b7b585d8647fa02c394d2506ed0b6205ccc58dab7bd4b5106987
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD522daf9abb0625983e0a575faae093eb4
SHA1487c37d6cd363024a8d0a4eee9e1659364b62c09
SHA2562c2fbd951348c8f5968a720a67868efc2e5e8f9a17470018899a9343c6f49843
SHA512d154bd32374465a82a31d591ead9d22ac6f6a3e7cbdcfcc26610d59435b508148c02a6e0efce45f37166f6d1d8251a755b007e3658c6a2a84ff01e198496f6ac
-
Filesize
72KB
MD522daf9abb0625983e0a575faae093eb4
SHA1487c37d6cd363024a8d0a4eee9e1659364b62c09
SHA2562c2fbd951348c8f5968a720a67868efc2e5e8f9a17470018899a9343c6f49843
SHA512d154bd32374465a82a31d591ead9d22ac6f6a3e7cbdcfcc26610d59435b508148c02a6e0efce45f37166f6d1d8251a755b007e3658c6a2a84ff01e198496f6ac
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5219efcc56a6561f6bc144410bf6e28cb
SHA158ec75047897bc0f7bee07d5fb23b29c83be929b
SHA256dad368957227bef299bf460e01e50943410347f6df18f4321c0888585052c463
SHA512173770f2856f627406edd4fcf1750f6763404f1156801821900b9683314e73d7b75d1817776fbe0ce62d113252b4e95a41a3914100aaf4fa89c1b17b628aa046
-
Filesize
72KB
MD5219efcc56a6561f6bc144410bf6e28cb
SHA158ec75047897bc0f7bee07d5fb23b29c83be929b
SHA256dad368957227bef299bf460e01e50943410347f6df18f4321c0888585052c463
SHA512173770f2856f627406edd4fcf1750f6763404f1156801821900b9683314e73d7b75d1817776fbe0ce62d113252b4e95a41a3914100aaf4fa89c1b17b628aa046
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD5a0a7049e38c485a6a1291df79f3c18c8
SHA1f746d2eed90a4dcc302797ab45a0a2aaf0fa43aa
SHA256229ac3f8f8100722d72f532f7d3b55adb1bc9d475a5296cb3fed7bee9651295a
SHA512fb302aacd9a9bebb1a120fa2c0c85dac1d18bd5db1438e5cd684f704b16aa2b8a1ebd4b09c169091709c9ecce44c5ae94c444e9b078c1d851942794d94f4ec7f
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD533aecd52463c7c1c8a5c56d8153dc750
SHA1eddda0180f5f0d39e356ec6f5d94151a9fd009df
SHA256d2179ce9d6200d4326448e2c59c006337f2910c73af92a11b816c035ea1f971d
SHA512004afbcec15cff678b720111e2447784ea815c2c693e96e51e03f891559e60484c2fabce59c7b7b585d8647fa02c394d2506ed0b6205ccc58dab7bd4b5106987
-
Filesize
72KB
MD533aecd52463c7c1c8a5c56d8153dc750
SHA1eddda0180f5f0d39e356ec6f5d94151a9fd009df
SHA256d2179ce9d6200d4326448e2c59c006337f2910c73af92a11b816c035ea1f971d
SHA512004afbcec15cff678b720111e2447784ea815c2c693e96e51e03f891559e60484c2fabce59c7b7b585d8647fa02c394d2506ed0b6205ccc58dab7bd4b5106987
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD511f0ec6cdae83f2199fb7b1d1a1d2756
SHA17e9d611c53f02a817ef38667e9e7d3968920af78
SHA25630a0df67956ded317e8c9ccbbb197327c07b1ff428fe9193f348dd63c12b7bfe
SHA512de2d5f33a20ddac8612696df9caae4d075ebab2e00bb794fa73d63ea503a82fa8cfeb6e0dba87c27e84d351dd876f730741273e9a031e73e00ab1dd25b90ab4c
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD5344ac3d4cc47dd3eef0f8e7122f500f2
SHA11269896461ee6fa37d8f978fe85b7dd7acb232a7
SHA25678c3ea28025b942055b5b6f9983dd329e00b5d08c786bfdd642087e873f3eea7
SHA512cf0b89e9d7fba905ce890138454f742788d7452b89361dc2357730ecf8f58f726b6264b542b6802aed20413ddb3f50ea1b26c320fb0e098d06e29d80dfff96a9
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD55f396c6285634a1a881ea2fc1d744920
SHA1f0ed89b1caa0523584b6604a2404cd0e86bfd1cc
SHA2560c7de83e5fefc2beab143116847924f9daf8d17c61fd8d037dadf344d1091a05
SHA512e654b94dd9d32f0e2bbf2228b4ae95ea0e167fba09b252c6387053c3ab7820bea942aee2a864dc522f4e06e288684ea5ce0206c8a0ea309b11a3b9d299358d30
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5d53a5269d461f92564843a81df56a85f
SHA1d54cb0b066bf2c299138ddc5fb805c58b3b875f2
SHA256cb0d8c9bb921e7341b2dff75d8f9ec6879c3a3fe7f9d6b974cce567dcd54ced2
SHA512639bdbc4db2eeec89c064867c41d8eae5ed17f97dbce8de3e8654db1a7029c5c3fdb70fab2f217ad10776dd33787b43ed3d443f5e04cf10b14810dd5098f63d4
-
Filesize
72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3
-
Filesize
72KB
MD5bef5cbbd1b50b95e929fb49886053306
SHA1d6b1358ecd52cbd7cd2be859489d50af9af6f132
SHA2567884c06a4bb97a6452319fe5f5c28770e2e720ceea002a3d1e2be7f7985995d0
SHA5121d6ee0cad40cfa38a532a9bd03beee3d296ed8d98c7ed93fe34f020ff484a877510b9a1d674fe2022c313ca5c831ea98c52e1582eed0faa5a607f0a42f34f5e3