5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103

Analysis

max time kernel
143s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
Size

72KB
MD5

04d897617cb4216e42e947748024f1b9
SHA1

1b1674da5f41b777d905cc1520c1072111e99c6b
SHA256

5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103
SHA512

20a3ec017e277522c01ecceba10f20e425772fd32ddbf5875467db589fd200f0baca7054f61dab1180e4b2b071a187bf264f7ff7727e26c784344606d9999460
SSDEEP

768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr3Mv:teThavEjDWguK8v

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe

Executes dropped EXE 64 IoCs

pid	Process
1492	backup.exe
960	backup.exe
832	backup.exe
1712	backup.exe
1012	backup.exe
1388	backup.exe
1708	backup.exe
1680	backup.exe
876	backup.exe
1760	backup.exe
1768	backup.exe
1068	backup.exe
2012	backup.exe
2044	backup.exe
472	backup.exe
840	backup.exe
1460	backup.exe
916	backup.exe
1628	System Restore.exe
628	System Restore.exe
1976	backup.exe
524	backup.exe
1712	backup.exe
1564	backup.exe
1380	backup.exe
760	backup.exe
1608	backup.exe
1616	backup.exe
1124	backup.exe
340	backup.exe
1884	backup.exe
580	data.exe
1916	backup.exe
2004	System Restore.exe
1400	backup.exe
1496	backup.exe
1904	backup.exe
2036	backup.exe
1068	backup.exe
856	backup.exe
1900	backup.exe
1832	backup.exe
556	backup.exe
1720	backup.exe
1448	backup.exe
904	backup.exe
940	backup.exe
1724	backup.exe
1164	backup.exe
1688	backup.exe
1516	backup.exe
1920	backup.exe
272	backup.exe
560	backup.exe
340	backup.exe
876	backup.exe
1072	backup.exe
2032	backup.exe
1884	backup.exe
2004	System Restore.exe
1464	backup.exe
1512	backup.exe
1672	backup.exe
1068	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1680	backup.exe
1680	backup.exe
876	backup.exe
876	backup.exe
1680	backup.exe
1680	backup.exe
1768	backup.exe
1768	backup.exe
1068	backup.exe
1068	backup.exe
1768	backup.exe
1768	backup.exe
2044	backup.exe
2044	backup.exe
1768	backup.exe
2044	backup.exe
1768	backup.exe
2044	backup.exe
472	backup.exe
472	backup.exe
1680	backup.exe
1680	backup.exe
2044	backup.exe
1768	backup.exe
2044	backup.exe
1768	backup.exe
472	backup.exe
1680	backup.exe
1680	backup.exe
472	backup.exe
524	backup.exe
628	System Restore.exe
524	backup.exe
840	backup.exe
628	System Restore.exe
840	backup.exe
1976	backup.exe
916	backup.exe
1976	backup.exe
916	backup.exe
840	backup.exe
840	backup.exe
1712	backup.exe
1712	backup.exe
2044	backup.exe
1564	backup.exe
1564	backup.exe
2044	backup.exe
840	backup.exe
840	backup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\images\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\update.exe	update.exe
File opened for modification	C:\Program Files\DVD Maker\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe	backup.exe
File opened for modification	C:\Program Files\Microsoft Games\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\backup.exe	data.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\backup.exe	data.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Services\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\backup.exe	update.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\addins\backup.exe	backup.exe
File opened for modification	C:\Windows\assembly\backup.exe	backup.exe
File opened for modification	C:\Windows\Boot\System Restore.exe	backup.exe
File opened for modification	C:\Windows\backup.exe	backup.exe
File opened for modification	C:\Windows\AppCompat\backup.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\backup.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\AppPatch64\backup.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\Custom\backup.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\de-DE\backup.exe	backup.exe
File opened for modification	C:\Windows\Branding\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
1492	backup.exe
960	backup.exe
832	backup.exe
1712	backup.exe
1012	backup.exe
1388	backup.exe
1708	backup.exe
1680	backup.exe
876	backup.exe
1760	backup.exe
1768	backup.exe
1068	backup.exe
2012	backup.exe
2044	backup.exe
472	backup.exe
840	backup.exe
916	backup.exe
1460	backup.exe
1628	System Restore.exe
628	System Restore.exe
524	backup.exe
1976	backup.exe
1712	backup.exe
1380	backup.exe
1564	backup.exe
760	backup.exe
1124	backup.exe
1608	backup.exe
1616	backup.exe
340	backup.exe
580	data.exe
1916	backup.exe
1884	backup.exe
2004	System Restore.exe
1400	backup.exe
1496	backup.exe
2036	backup.exe
1068	backup.exe
1904	backup.exe
856	backup.exe
1832	backup.exe
556	backup.exe
1900	backup.exe
1720	backup.exe
904	backup.exe
1448	backup.exe
940	backup.exe
1724	backup.exe
1688	backup.exe
1516	backup.exe
1164	backup.exe
1920	backup.exe
560	backup.exe
272	backup.exe
876	backup.exe
340	backup.exe
2032	backup.exe
1072	backup.exe
2004	System Restore.exe
1884	backup.exe
1464	backup.exe
1512	backup.exe
1672	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1492	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	27
PID 1108 wrote to memory of 1492	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	27
PID 1108 wrote to memory of 1492	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	27
PID 1108 wrote to memory of 1492	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	27
PID 1108 wrote to memory of 960	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	28
PID 1108 wrote to memory of 960	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	28
PID 1108 wrote to memory of 960	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	28
PID 1108 wrote to memory of 960	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	28
PID 1108 wrote to memory of 832	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	29
PID 1108 wrote to memory of 832	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	29
PID 1108 wrote to memory of 832	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	29
PID 1108 wrote to memory of 832	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	29
PID 1108 wrote to memory of 1712	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	30
PID 1108 wrote to memory of 1712	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	30
PID 1108 wrote to memory of 1712	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	30
PID 1108 wrote to memory of 1712	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	30
PID 1108 wrote to memory of 1012	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	31
PID 1108 wrote to memory of 1012	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	31
PID 1108 wrote to memory of 1012	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	31
PID 1108 wrote to memory of 1012	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	31
PID 1108 wrote to memory of 1388	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	32
PID 1108 wrote to memory of 1388	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	32
PID 1108 wrote to memory of 1388	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	32
PID 1108 wrote to memory of 1388	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	32
PID 1108 wrote to memory of 1708	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	33
PID 1108 wrote to memory of 1708	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	33
PID 1108 wrote to memory of 1708	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	33
PID 1108 wrote to memory of 1708	1108	5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe	33
PID 1492 wrote to memory of 1680	1492	backup.exe	34
PID 1492 wrote to memory of 1680	1492	backup.exe	34
PID 1492 wrote to memory of 1680	1492	backup.exe	34
PID 1492 wrote to memory of 1680	1492	backup.exe	34
PID 1680 wrote to memory of 876	1680	backup.exe	35
PID 1680 wrote to memory of 876	1680	backup.exe	35
PID 1680 wrote to memory of 876	1680	backup.exe	35
PID 1680 wrote to memory of 876	1680	backup.exe	35
PID 876 wrote to memory of 1760	876	backup.exe	36
PID 876 wrote to memory of 1760	876	backup.exe	36
PID 876 wrote to memory of 1760	876	backup.exe	36
PID 876 wrote to memory of 1760	876	backup.exe	36
PID 1680 wrote to memory of 1768	1680	backup.exe	37
PID 1680 wrote to memory of 1768	1680	backup.exe	37
PID 1680 wrote to memory of 1768	1680	backup.exe	37
PID 1680 wrote to memory of 1768	1680	backup.exe	37
PID 1768 wrote to memory of 1068	1768	backup.exe	38
PID 1768 wrote to memory of 1068	1768	backup.exe	38
PID 1768 wrote to memory of 1068	1768	backup.exe	38
PID 1768 wrote to memory of 1068	1768	backup.exe	38
PID 1068 wrote to memory of 2012	1068	backup.exe	39
PID 1068 wrote to memory of 2012	1068	backup.exe	39
PID 1068 wrote to memory of 2012	1068	backup.exe	39
PID 1068 wrote to memory of 2012	1068	backup.exe	39
PID 1768 wrote to memory of 2044	1768	backup.exe	40
PID 1768 wrote to memory of 2044	1768	backup.exe	40
PID 1768 wrote to memory of 2044	1768	backup.exe	40
PID 1768 wrote to memory of 2044	1768	backup.exe	40
PID 2044 wrote to memory of 472	2044	backup.exe	41
PID 2044 wrote to memory of 472	2044	backup.exe	41
PID 2044 wrote to memory of 472	2044	backup.exe	41
PID 2044 wrote to memory of 472	2044	backup.exe	41
PID 1768 wrote to memory of 840	1768	backup.exe	42
PID 1768 wrote to memory of 840	1768	backup.exe	42
PID 1768 wrote to memory of 840	1768	backup.exe	42
PID 1768 wrote to memory of 840	1768	backup.exe	42

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe
"C:\Users\Admin\AppData\Local\Temp\5a1efbc8deefebe2f67c38d81b2a749ef8a959a795004f1d07b03a9c62459103.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\2571409528\backup.exe
  C:\Users\Admin\AppData\Local\Temp\2571409528\backup.exe C:\Users\Admin\AppData\Local\Temp\2571409528\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1680
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:876
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1768
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2044
      - C:\Program Files\Common Files\Microsoft Shared\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:472
        
        C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:340
        
        C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
        8⤵
        
        PID:2004
        
        C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2036
        
        C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:904
        
        C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1688
        
        C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:340
        
        C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1840
        
        C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:840
        
        C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
        8⤵
        
        PID:1464
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
        8⤵
        
        PID:628
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
        8⤵
        
        PID:2032
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
        8⤵
        
        PID:1904
        
        C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
        8⤵
        
        PID:2076
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1512
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1828
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
        8⤵
        System policy modification
        
        PID:1500
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
        8⤵
        System policy modification
        
        PID:1932
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1536
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
        8⤵
        
        PID:1516
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
        8⤵
        
        PID:1976
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        7⤵
        
        PID:1124
        
        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
        7⤵
        
        PID:1044
        
        C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
        7⤵
        
        PID:1832
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
      - C:\Program Files\Common Files\SpeechEngines\System Restore.exe
        
        "C:\Program Files\Common Files\SpeechEngines\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:628
        
        C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1380
      - C:\Program Files\Common Files\System\data.exe
        
        "C:\Program Files\Common Files\System\data.exe" C:\Program Files\Common Files\System\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:580
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:856
        
        C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
        
        C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1672
        
        C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:968
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1544
        
        C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:560
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1608
        
        C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        7⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1388
        
        C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        7⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1580
        
        C:\Program Files\Common Files\System\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:672
        
        C:\Program Files\Common Files\System\msadc\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
        7⤵
        
        PID:1464
        
        C:\Program Files\Common Files\System\Ole DB\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1680
        
        C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
        8⤵
        
        PID:1372
        
        C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
        8⤵
        
        PID:1196
    - - C:\Program Files\DVD Maker\backup.exe
        
        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:840
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Executes dropped EXE
        
        PID:1884
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Program Files\DVD Maker\it-IT\backup.exe
        
        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1516
      - C:\Program Files\DVD Maker\Shared\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:272
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2004
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
        8⤵
        
        PID:1140
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1920
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1904
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1392
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:932
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1348
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
        8⤵
        
        PID:1564
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\data.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
        8⤵
        
        PID:1808
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
        8⤵
        
        PID:560
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Program Files\Google\Chrome\Application\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
        9⤵
        System policy modification
        
        PID:1152
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
        9⤵
        Modifies visibility of file extensions in Explorer
        
        PID:980
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
        9⤵
        
        PID:904
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
        9⤵
        
        PID:1580
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
        9⤵
        
        PID:1340
        
        C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1464
        
        C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
        8⤵
        
        PID:1392
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System policy modification
        
        PID:1068
      - C:\Program Files\Internet Explorer\de-DE\backup.exe
        
        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
        6⤵
        
        PID:1480
      - C:\Program Files\Internet Explorer\en-US\backup.exe
        
        "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
        6⤵
        System policy modification
        
        PID:1884
      - C:\Program Files\Internet Explorer\es-ES\backup.exe
        
        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1000
      - C:\Program Files\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
        6⤵
        
        PID:1912
      - C:\Program Files\Internet Explorer\images\update.exe
        
        "C:\Program Files\Internet Explorer\images\update.exe" C:\Program Files\Internet Explorer\images\
        6⤵
        
        PID:1764
      - C:\Program Files\Internet Explorer\it-IT\backup.exe
        
        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
        6⤵
        
        PID:1684
      - C:\Program Files\Internet Explorer\ja-JP\backup.exe
        
        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
        6⤵
        
        PID:628
      - C:\Program Files\Internet Explorer\SIGNUP\backup.exe
        
        "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
        6⤵
        
        PID:980
    - - C:\Program Files\Java\data.exe
        
        "C:\Program Files\Java\data.exe" C:\Program Files\Java\
        5⤵
        
        PID:1032
    - - C:\Program Files\Microsoft Games\backup.exe
        
        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:1884
    - - C:\Program Files\Microsoft Office\backup.exe
        
        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
        5⤵
        
        PID:1500
    - - C:\Program Files\Mozilla Firefox\backup.exe
        
        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
        5⤵
        
        PID:2052
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:916
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1616
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1496
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1832
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1724
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1920
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:808
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1112
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
        9⤵
        
        PID:1604
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1600
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        8⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Program Files directory
        System policy modification
        
        PID:1752
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
        9⤵
        
        PID:1484
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        8⤵
        
        PID:2040
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        8⤵
        
        PID:1692
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        8⤵
        
        PID:2096
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        Drops file in Program Files directory
        
        PID:1476
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
        8⤵
        Drops file in Program Files directory
        
        PID:2040
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
        9⤵
        
        PID:1072
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1124
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        8⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Program Files directory
        System policy modification
        
        PID:1808
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
        9⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:340
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
        9⤵
        
        PID:1152
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
        8⤵
        
        PID:1416
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
        8⤵
        
        PID:2008
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        
        PID:1576
    - - C:\Program Files (x86)\Common Files\update.exe
        
        "C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Program Files directory
        System policy modification
        
        PID:1180
      - C:\Program Files (x86)\Common Files\Adobe\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
        6⤵
        Drops file in Program Files directory
        
        PID:1656
        
        C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
        7⤵
        System policy modification
        
        PID:1032
        
        C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
        7⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Program Files directory
        System policy modification
        
        PID:1908
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
        8⤵
        
        PID:1092
        
        C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
        7⤵
        
        PID:1544
      - C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
        6⤵
        
        PID:1588
      - C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
        
        "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
        6⤵
        
        PID:1468
      - C:\Program Files (x86)\Common Files\microsoft shared\update.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\
        6⤵
        
        PID:268
      - C:\Program Files (x86)\Common Files\Services\System Restore.exe
        
        "C:\Program Files (x86)\Common Files\Services\System Restore.exe" C:\Program Files (x86)\Common Files\Services\
        6⤵
        
        PID:1552
    - - C:\Program Files (x86)\Google\data.exe
        
        "C:\Program Files (x86)\Google\data.exe" C:\Program Files (x86)\Google\
        5⤵
        
        PID:1448
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        
        PID:1496
    - - C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\
        5⤵
        
        PID:1760
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:524
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1564
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\Desktop\backup.exe
        
        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1068
      - C:\Users\Admin\Documents\backup.exe
        
        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\Downloads\backup.exe
        
        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
      - C:\Users\Admin\Favorites\backup.exe
        
        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Users\Admin\Links\backup.exe
        
        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1884
      - C:\Users\Admin\Music\data.exe
        
        C:\Users\Admin\Music\data.exe C:\Users\Admin\Music\
        6⤵
        
        PID:2012
      - C:\Users\Admin\Pictures\backup.exe
        
        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
        6⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1588
      - C:\Users\Admin\Saved Games\update.exe
        
        "C:\Users\Admin\Saved Games\update.exe" C:\Users\Admin\Saved Games\
        6⤵
        
        PID:1616
      - C:\Users\Admin\Searches\backup.exe
        
        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
        6⤵
        
        PID:1572
      - C:\Users\Admin\Videos\backup.exe
        
        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
        6⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1636
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        
        PID:780
      - C:\Users\Public\Documents\backup.exe
        
        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
        6⤵
        
        PID:1628
      - C:\Users\Public\Downloads\backup.exe
        
        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
        6⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1576
      - C:\Users\Public\Music\backup.exe
        
        C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
        6⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1188
        
        C:\Users\Public\Music\Sample Music\backup.exe
        
        "C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
        7⤵
        Modifies visibility of file extensions in Explorer
        System policy modification
        
        PID:1604
      - C:\Users\Public\Pictures\backup.exe
        
        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
        6⤵
        
        PID:1996
      - C:\Users\Public\Recorded TV\backup.exe
        
        "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
        6⤵
        
        PID:1940
      - C:\Users\Public\Videos\backup.exe
        
        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
        6⤵
        
        PID:940
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      Drops file in Windows directory
      System policy modification
      PID:688
    - - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        5⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2044
    - - C:\Windows\AppCompat\backup.exe
        
        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
        5⤵
        Modifies visibility of file extensions in Explorer
        
        PID:844
    - - C:\Windows\AppPatch\backup.exe
        
        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
        5⤵
        Modifies visibility of file extensions in Explorer
        Drops file in Windows directory
        System policy modification
        
        PID:1688
      - C:\Windows\AppPatch\AppPatch64\backup.exe
        
        C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
        6⤵
        
        PID:1936
      - C:\Windows\AppPatch\Custom\backup.exe
        
        C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
        6⤵
        
        PID:856
      - C:\Windows\AppPatch\de-DE\backup.exe
        
        C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\
        6⤵
        
        PID:1608
      - C:\Windows\AppPatch\en-US\backup.exe
        
        C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
        6⤵
        
        PID:2012
      - C:\Windows\AppPatch\es-ES\backup.exe
        
        C:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\
        6⤵
        
        PID:316
    - - C:\Windows\assembly\backup.exe
        
        C:\Windows\assembly\backup.exe C:\Windows\assembly\
        5⤵
        
        PID:1968
    - - C:\Windows\Branding\backup.exe
        
        C:\Windows\Branding\backup.exe C:\Windows\Branding\
        5⤵
        
        PID:1928
    - - C:\Windows\CSC\backup.exe
        
        C:\Windows\CSC\backup.exe C:\Windows\CSC\
        5⤵
        
        PID:1924
    - - C:\Windows\Cursors\backup.exe
        
        C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
        5⤵
        
        PID:1224
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:960
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:832
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1012
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
a20ab9b5544263198b668ec2ac6145bc

SHA1
9da5c31f057a591480949888c2942dc03f3387da

SHA256
11589a11542bcd6334c4c8486d52f5c0759fb8a76f0678516f72b38911338eb3

SHA512
56b700a66452ced16c6d59f157e004c700a255765360f89e55c19266c49a2e92ca2e0c7584df35a635decbef655dc11ac653189725c91587b1206356a70851db

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
ded3f3727261254db67d0b068802baa9

SHA1
59bf793a6a57e1ff39a9a97c379fe4f1daa7fb51

SHA256
5de2d50f510021cb36141c90900fe98239c97cfeb7bf8920af106bef99dace80

SHA512
38c4b90023be43da0b104d68aa131aee6a5cfd75493ed1cd6a02ef365c03647a9931d24ea6dccdd1710de234fdaab1458439403c4bcd796aedcb286979d3b724

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe

Filesize
72KB

MD5
73fbeb4b6a1af26681ca201a0b753f7e

SHA1
8035d2c15993723deb51f6896a11406cb5f9591c

SHA256
8b3f8fe4b9440b38ea147f2091d4b4ee0194197cea8c781b881a7fafef772551

SHA512
e3fa80da3d95477980e7a0b24ba2d19772af265685224e1bda03c524cdf9e54eb580b4867c8659fe68a4f516f168faa146a62119ae98ba792fb8d1d0c438f9a2

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
3484a185b435e8b78ad2cdc09f3fe2c4

SHA1
7489d631a53008d43be478d47ee18abaab15879e

SHA256
29c5bf9759f8437d574b52c66344fc740d06d7c1b8c68f10417ee68ef571922b

SHA512
f950476e0bb9c325db863d8975140e4425b5b96bf86c664449b4fa765e0fb096b95d108dc9845003ba79fec314c49db5e166443cf77e9f186c7a23ba7e36bcf4

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
3484a185b435e8b78ad2cdc09f3fe2c4

SHA1
7489d631a53008d43be478d47ee18abaab15879e

SHA256
29c5bf9759f8437d574b52c66344fc740d06d7c1b8c68f10417ee68ef571922b

SHA512
f950476e0bb9c325db863d8975140e4425b5b96bf86c664449b4fa765e0fb096b95d108dc9845003ba79fec314c49db5e166443cf77e9f186c7a23ba7e36bcf4

Download Submit
C:\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
dfabacac218bebdbc0aae5fd274bda60

SHA1
8b657d7d35f27d2e18ceeb78e5740c59f3247604

SHA256
28bd8b741ee324d011334bbb9f0322343b55cd9ae6e83ddb7b3bc950ebf48210

SHA512
f5e01729315cd714ed8107353e2441c355047296b167d6d645cdc489638ff5fce6003855139c634f5ad323da698984906b8a142e1a25c62db65828539c8f2887

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
C:\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
62f6ddbce8a3b0f7b6acace1b958926e

SHA1
5a63193ce0e9c6b28752d7c8982985e42c016c91

SHA256
01c17ca975d8639e3396b229734144c80e330879b239fe1f685ddbdcb719eb2f

SHA512
2e6566137ec741c29a717a3b0736d1054f586a9b926adb516caea7c4fde157a7bdfce646ded487e535bb135c0f264d911c7b86324557d9542d62747eb44d764a

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
C:\Users\Admin\AppData\Local\Temp\2571409528\backup.exe

Filesize
72KB

MD5
af84a0243ba92216a82217d47116a963

SHA1
2ff7e0f4b2f6f1ae1d0d41ddab4e1454020e56bb

SHA256
a00d14f5f41f309f22e45519dc26f3274ddde9ccf5479a01779c4bdfccab3f52

SHA512
dc015c74329f9751f43c72490bb287baabeaaa15b0cfcf8bd2750aee24da3e3bd275c49a9d4c06af25d0d052c96428ea346d873a00acbbe09bebf8107241dbf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2571409528\backup.exe

Filesize
72KB

MD5
af84a0243ba92216a82217d47116a963

SHA1
2ff7e0f4b2f6f1ae1d0d41ddab4e1454020e56bb

SHA256
a00d14f5f41f309f22e45519dc26f3274ddde9ccf5479a01779c4bdfccab3f52

SHA512
dc015c74329f9751f43c72490bb287baabeaaa15b0cfcf8bd2750aee24da3e3bd275c49a9d4c06af25d0d052c96428ea346d873a00acbbe09bebf8107241dbf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
C:\backup.exe

Filesize
72KB

MD5
4a0f61b2f6223f0dd20491362a474ef5

SHA1
1ec56bc8ba1b81143267d74c707bf4c311b5847b

SHA256
88228eb9b4f870879c37f303be8026763bd1f6707e11cd69cd7d86c413539a6f

SHA512
4ee827d907be66ba860c48b269ce50aecf7a038b96e50698258e120d6d769494250266bd704eecee41323ed7abf6ca452cba77df28448c9c4eae5825284b22e7

Download Submit
C:\backup.exe

Filesize
72KB

MD5
4a0f61b2f6223f0dd20491362a474ef5

SHA1
1ec56bc8ba1b81143267d74c707bf4c311b5847b

SHA256
88228eb9b4f870879c37f303be8026763bd1f6707e11cd69cd7d86c413539a6f

SHA512
4ee827d907be66ba860c48b269ce50aecf7a038b96e50698258e120d6d769494250266bd704eecee41323ed7abf6ca452cba77df28448c9c4eae5825284b22e7

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
a20ab9b5544263198b668ec2ac6145bc

SHA1
9da5c31f057a591480949888c2942dc03f3387da

SHA256
11589a11542bcd6334c4c8486d52f5c0759fb8a76f0678516f72b38911338eb3

SHA512
56b700a66452ced16c6d59f157e004c700a255765360f89e55c19266c49a2e92ca2e0c7584df35a635decbef655dc11ac653189725c91587b1206356a70851db

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
a20ab9b5544263198b668ec2ac6145bc

SHA1
9da5c31f057a591480949888c2942dc03f3387da

SHA256
11589a11542bcd6334c4c8486d52f5c0759fb8a76f0678516f72b38911338eb3

SHA512
56b700a66452ced16c6d59f157e004c700a255765360f89e55c19266c49a2e92ca2e0c7584df35a635decbef655dc11ac653189725c91587b1206356a70851db

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
ded3f3727261254db67d0b068802baa9

SHA1
59bf793a6a57e1ff39a9a97c379fe4f1daa7fb51

SHA256
5de2d50f510021cb36141c90900fe98239c97cfeb7bf8920af106bef99dace80

SHA512
38c4b90023be43da0b104d68aa131aee6a5cfd75493ed1cd6a02ef365c03647a9931d24ea6dccdd1710de234fdaab1458439403c4bcd796aedcb286979d3b724

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
ded3f3727261254db67d0b068802baa9

SHA1
59bf793a6a57e1ff39a9a97c379fe4f1daa7fb51

SHA256
5de2d50f510021cb36141c90900fe98239c97cfeb7bf8920af106bef99dace80

SHA512
38c4b90023be43da0b104d68aa131aee6a5cfd75493ed1cd6a02ef365c03647a9931d24ea6dccdd1710de234fdaab1458439403c4bcd796aedcb286979d3b724

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe

Filesize
72KB

MD5
73fbeb4b6a1af26681ca201a0b753f7e

SHA1
8035d2c15993723deb51f6896a11406cb5f9591c

SHA256
8b3f8fe4b9440b38ea147f2091d4b4ee0194197cea8c781b881a7fafef772551

SHA512
e3fa80da3d95477980e7a0b24ba2d19772af265685224e1bda03c524cdf9e54eb580b4867c8659fe68a4f516f168faa146a62119ae98ba792fb8d1d0c438f9a2

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe

Filesize
72KB

MD5
73fbeb4b6a1af26681ca201a0b753f7e

SHA1
8035d2c15993723deb51f6896a11406cb5f9591c

SHA256
8b3f8fe4b9440b38ea147f2091d4b4ee0194197cea8c781b881a7fafef772551

SHA512
e3fa80da3d95477980e7a0b24ba2d19772af265685224e1bda03c524cdf9e54eb580b4867c8659fe68a4f516f168faa146a62119ae98ba792fb8d1d0c438f9a2

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
3484a185b435e8b78ad2cdc09f3fe2c4

SHA1
7489d631a53008d43be478d47ee18abaab15879e

SHA256
29c5bf9759f8437d574b52c66344fc740d06d7c1b8c68f10417ee68ef571922b

SHA512
f950476e0bb9c325db863d8975140e4425b5b96bf86c664449b4fa765e0fb096b95d108dc9845003ba79fec314c49db5e166443cf77e9f186c7a23ba7e36bcf4

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
3484a185b435e8b78ad2cdc09f3fe2c4

SHA1
7489d631a53008d43be478d47ee18abaab15879e

SHA256
29c5bf9759f8437d574b52c66344fc740d06d7c1b8c68f10417ee68ef571922b

SHA512
f950476e0bb9c325db863d8975140e4425b5b96bf86c664449b4fa765e0fb096b95d108dc9845003ba79fec314c49db5e166443cf77e9f186c7a23ba7e36bcf4

Download Submit
\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
dfabacac218bebdbc0aae5fd274bda60

SHA1
8b657d7d35f27d2e18ceeb78e5740c59f3247604

SHA256
28bd8b741ee324d011334bbb9f0322343b55cd9ae6e83ddb7b3bc950ebf48210

SHA512
f5e01729315cd714ed8107353e2441c355047296b167d6d645cdc489638ff5fce6003855139c634f5ad323da698984906b8a142e1a25c62db65828539c8f2887

Download Submit
\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
dfabacac218bebdbc0aae5fd274bda60

SHA1
8b657d7d35f27d2e18ceeb78e5740c59f3247604

SHA256
28bd8b741ee324d011334bbb9f0322343b55cd9ae6e83ddb7b3bc950ebf48210

SHA512
f5e01729315cd714ed8107353e2441c355047296b167d6d645cdc489638ff5fce6003855139c634f5ad323da698984906b8a142e1a25c62db65828539c8f2887

Download Submit
\Program Files\Common Files\SpeechEngines\System Restore.exe

Filesize
72KB

MD5
6deade482be55f894f783cdc9cec8de6

SHA1
8f6d6bff272452a53a44f6cdc452a4dc218892c9

SHA256
596ecfeb9008db9e70677425da710245faa47d3415f0718bde2db592bbb14800

SHA512
ccb6ffc8d741ee8599424054f0ed8aefacda467ddb5385cd92c43785fc4e191265ec3e8535260231c02a9a82e856068fa00035cdcddd86ab159c1e980c1b7e25

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
4d0f5f12e694146954907f0437ada362

SHA1
266796bf057570e6df4c1923383d2a0a64a247b2

SHA256
33ad4cfbfa1d92504c3ec55818eaaedbe1ba5e1fb88d3097d6422db0ff601029

SHA512
14b957f03181b574f171296abe8d57848121841098e28e7e9a18f1b0316538ae8a491c13ac294eb0d710a89d5eda74cdcd666c358e4b961573170d4b6f9ae593

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
62f6ddbce8a3b0f7b6acace1b958926e

SHA1
5a63193ce0e9c6b28752d7c8982985e42c016c91

SHA256
01c17ca975d8639e3396b229734144c80e330879b239fe1f685ddbdcb719eb2f

SHA512
2e6566137ec741c29a717a3b0736d1054f586a9b926adb516caea7c4fde157a7bdfce646ded487e535bb135c0f264d911c7b86324557d9542d62747eb44d764a

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
62f6ddbce8a3b0f7b6acace1b958926e

SHA1
5a63193ce0e9c6b28752d7c8982985e42c016c91

SHA256
01c17ca975d8639e3396b229734144c80e330879b239fe1f685ddbdcb719eb2f

SHA512
2e6566137ec741c29a717a3b0736d1054f586a9b926adb516caea7c4fde157a7bdfce646ded487e535bb135c0f264d911c7b86324557d9542d62747eb44d764a

Download Submit
\Program Files\Google\backup.exe

Filesize
72KB

MD5
166a754626669d03e49850d748b44b72

SHA1
f47a7be9510fa28c19bdb3308b19fa864d742b3a

SHA256
c3ee23804af276b1ae62459674ff7ab1aedd072a9e8ebe7050188f23df48db33

SHA512
80d636f1c6f5d5882ba675228562bd5554734b7225bcbd4ccbdead313ee6e2bcd32224149c663ba8dbba7dba2b5bc8b2e52a772ee7b95464387fa92c12d7b147

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
3d8fb909c4061a670f99e1bcde73672a

SHA1
c703f147480339731723ccfa43deadff1312fc2a

SHA256
5196f149f8310aab376fd9b1aa27c47da2b4173d055846dbc2e0039f841e8ad3

SHA512
b68d5649fd573d20c516f09dad214ae9096f5f1c1f6ad7b6922b618766404699d7d884484469d4ec06e187277a198f36a5ee32c47b9af58fd08a2c50728b1939

Download Submit
\Users\Admin\AppData\Local\Temp\2571409528\backup.exe

Filesize
72KB

MD5
af84a0243ba92216a82217d47116a963

SHA1
2ff7e0f4b2f6f1ae1d0d41ddab4e1454020e56bb

SHA256
a00d14f5f41f309f22e45519dc26f3274ddde9ccf5479a01779c4bdfccab3f52

SHA512
dc015c74329f9751f43c72490bb287baabeaaa15b0cfcf8bd2750aee24da3e3bd275c49a9d4c06af25d0d052c96428ea346d873a00acbbe09bebf8107241dbf9

Download Submit
\Users\Admin\AppData\Local\Temp\2571409528\backup.exe

Filesize
72KB

MD5
af84a0243ba92216a82217d47116a963

SHA1
2ff7e0f4b2f6f1ae1d0d41ddab4e1454020e56bb

SHA256
a00d14f5f41f309f22e45519dc26f3274ddde9ccf5479a01779c4bdfccab3f52

SHA512
dc015c74329f9751f43c72490bb287baabeaaa15b0cfcf8bd2750aee24da3e3bd275c49a9d4c06af25d0d052c96428ea346d873a00acbbe09bebf8107241dbf9

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
01b9489d815a7e1be0fe36c7dcf35062

SHA1
dca982fcc688b247b27199ca5d559ccb165147cc

SHA256
bb7bc90a7a50fbaeee07696c06c2c387fe4b6db4b4190bcbe488d57cb0f49899

SHA512
aaa8a6067f0cb4ceac0c1878ae7b61af06aae362918072f30acb1008f23d3747aedb1f7a887abc93ce5adc5460ba8ef1041b853955c8172e978c3ee5bdf10aa5

Download Submit
memory/1108-105-0x0000000074901000-0x0000000074903000-memory.dmp

Filesize
8KB

Download
memory/1108-98-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads