20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd

Analysis

max time kernel
124s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
Size

72KB
MD5

0d4b6365fc3e16318df9a711f51a0e9e
SHA1

f3bd1f90f2fceef697658f624c4a8213cd4ba2d2
SHA256

20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd
SHA512

0906a786e4ead16ca9e3d87be6a8684b64729a0e6d1c6d631f2808ece351bd708c1b9040ae1cb94eaf9872ccb92a9ad9330a7b6c3b8ac9e7573dd2e58bfe213b
SSDEEP

768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyvg:HeT7BVwxfvqguKRFAl

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Executes dropped EXE 64 IoCs

pid	Process
968	System Restore.exe
1404	backup.exe
1744	backup.exe
336	data.exe
1372	backup.exe
672	backup.exe
688	backup.exe
1064	backup.exe
836	backup.exe
1084	backup.exe
1920	backup.exe
1944	backup.exe
1392	data.exe
1040	backup.exe
1928	backup.exe
440	backup.exe
980	backup.exe
964	backup.exe
1752	backup.exe
1244	backup.exe
1648	backup.exe
1660	backup.exe
900	backup.exe
896	backup.exe
1900	backup.exe
268	backup.exe
672	backup.exe
1688	backup.exe
1984	backup.exe
2044	backup.exe
1064	backup.exe
556	backup.exe
1200	backup.exe
1988	backup.exe
824	backup.exe
1544	backup.exe
1944	backup.exe
1036	backup.exe
112	backup.exe
2012	backup.exe
1112	backup.exe
1960	backup.exe
1692	backup.exe
1364	backup.exe
1240	backup.exe
956	System Restore.exe
1784	data.exe
2032	backup.exe
1624	System Restore.exe
1628	backup.exe
1788	System Restore.exe
840	backup.exe
1360	data.exe
1640	backup.exe
2000	backup.exe
572	backup.exe
824	backup.exe
1564	backup.exe
1516	backup.exe
1984	backup.exe
1844	backup.exe
960	backup.exe
1492	backup.exe
976	data.exe

Loads dropped DLL 64 IoCs

pid	Process
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
688	backup.exe
688	backup.exe
836	backup.exe
836	backup.exe
688	backup.exe
688	backup.exe
1920	backup.exe
1920	backup.exe
1944	backup.exe
1944	backup.exe
1920	backup.exe
1920	backup.exe
1040	backup.exe
1040	backup.exe
1928	backup.exe
1928	backup.exe
1040	backup.exe
1040	backup.exe
688	backup.exe
688	backup.exe
1920	backup.exe
1920	backup.exe
1928	backup.exe
1928	backup.exe
1040	backup.exe
688	backup.exe
688	backup.exe
1040	backup.exe
1920	backup.exe
1920	backup.exe
1928	backup.exe
1928	backup.exe
1920	backup.exe
1920	backup.exe
1040	backup.exe
1040	backup.exe
1244	backup.exe
1244	backup.exe
900	backup.exe
900	backup.exe
1660	backup.exe
1660	backup.exe
1648	backup.exe
1648	backup.exe
1900	backup.exe
1900	backup.exe
1752	backup.exe
1752	backup.exe
964	backup.exe
964	backup.exe

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\data.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\data.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe	backup.exe
File opened for modification	C:\Program Files\Java\backup.exe	backup.exe
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Services\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\images\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\data.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe	data.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe	backup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AppPatch\de-DE\backup.exe	System Restore.exe
File opened for modification	C:\Windows\assembly\backup.exe	backup.exe
File opened for modification	C:\Windows\backup.exe	backup.exe
File opened for modification	C:\Windows\addins\backup.exe	backup.exe
File opened for modification	C:\Windows\AppCompat\backup.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\System Restore.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\AppPatch64\backup.exe	System Restore.exe
File opened for modification	C:\Windows\AppPatch\Custom\backup.exe	System Restore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
968	System Restore.exe
1404	backup.exe
1744	backup.exe
336	data.exe
1372	backup.exe
672	backup.exe
688	backup.exe
1064	backup.exe
836	backup.exe
1084	backup.exe
1920	backup.exe
1944	backup.exe
1392	data.exe
1040	backup.exe
1928	backup.exe
440	backup.exe
980	backup.exe
964	backup.exe
1752	backup.exe
1244	backup.exe
1648	backup.exe
900	backup.exe
1660	backup.exe
896	backup.exe
1900	backup.exe
268	backup.exe
672	backup.exe
1200	backup.exe
1064	backup.exe
1988	backup.exe
2044	backup.exe
1688	backup.exe
1984	backup.exe
556	backup.exe
824	backup.exe
1944	backup.exe
112	backup.exe
2012	backup.exe
1544	backup.exe
1364	backup.exe
1036	backup.exe
1112	backup.exe
1960	backup.exe
1692	backup.exe
1784	data.exe
1240	backup.exe
1628	backup.exe
840	backup.exe
956	System Restore.exe
2032	backup.exe
1624	System Restore.exe
1788	System Restore.exe
1360	data.exe
1640	backup.exe
2000	backup.exe
572	backup.exe
824	backup.exe
1516	backup.exe
1492	backup.exe
960	backup.exe
1564	backup.exe
1304	backup.exe
976	data.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 968	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	27
PID 1712 wrote to memory of 968	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	27
PID 1712 wrote to memory of 968	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	27
PID 1712 wrote to memory of 968	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	27
PID 1712 wrote to memory of 1404	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	28
PID 1712 wrote to memory of 1404	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	28
PID 1712 wrote to memory of 1404	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	28
PID 1712 wrote to memory of 1404	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	28
PID 1712 wrote to memory of 1744	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	29
PID 1712 wrote to memory of 1744	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	29
PID 1712 wrote to memory of 1744	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	29
PID 1712 wrote to memory of 1744	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	29
PID 1712 wrote to memory of 336	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	30
PID 1712 wrote to memory of 336	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	30
PID 1712 wrote to memory of 336	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	30
PID 1712 wrote to memory of 336	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	30
PID 1712 wrote to memory of 1372	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	31
PID 1712 wrote to memory of 1372	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	31
PID 1712 wrote to memory of 1372	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	31
PID 1712 wrote to memory of 1372	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	31
PID 1712 wrote to memory of 672	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	32
PID 1712 wrote to memory of 672	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	32
PID 1712 wrote to memory of 672	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	32
PID 1712 wrote to memory of 672	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	32
PID 968 wrote to memory of 688	968	System Restore.exe	33
PID 968 wrote to memory of 688	968	System Restore.exe	33
PID 968 wrote to memory of 688	968	System Restore.exe	33
PID 968 wrote to memory of 688	968	System Restore.exe	33
PID 1712 wrote to memory of 1064	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	34
PID 1712 wrote to memory of 1064	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	34
PID 1712 wrote to memory of 1064	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	34
PID 1712 wrote to memory of 1064	1712	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe	34
PID 688 wrote to memory of 836	688	backup.exe	35
PID 688 wrote to memory of 836	688	backup.exe	35
PID 688 wrote to memory of 836	688	backup.exe	35
PID 688 wrote to memory of 836	688	backup.exe	35
PID 836 wrote to memory of 1084	836	backup.exe	36
PID 836 wrote to memory of 1084	836	backup.exe	36
PID 836 wrote to memory of 1084	836	backup.exe	36
PID 836 wrote to memory of 1084	836	backup.exe	36
PID 688 wrote to memory of 1920	688	backup.exe	37
PID 688 wrote to memory of 1920	688	backup.exe	37
PID 688 wrote to memory of 1920	688	backup.exe	37
PID 688 wrote to memory of 1920	688	backup.exe	37
PID 1920 wrote to memory of 1944	1920	backup.exe	38
PID 1920 wrote to memory of 1944	1920	backup.exe	38
PID 1920 wrote to memory of 1944	1920	backup.exe	38
PID 1920 wrote to memory of 1944	1920	backup.exe	38
PID 1944 wrote to memory of 1392	1944	backup.exe	39
PID 1944 wrote to memory of 1392	1944	backup.exe	39
PID 1944 wrote to memory of 1392	1944	backup.exe	39
PID 1944 wrote to memory of 1392	1944	backup.exe	39
PID 1920 wrote to memory of 1040	1920	backup.exe	40
PID 1920 wrote to memory of 1040	1920	backup.exe	40
PID 1920 wrote to memory of 1040	1920	backup.exe	40
PID 1920 wrote to memory of 1040	1920	backup.exe	40
PID 1040 wrote to memory of 1928	1040	backup.exe	41
PID 1040 wrote to memory of 1928	1040	backup.exe	41
PID 1040 wrote to memory of 1928	1040	backup.exe	41
PID 1040 wrote to memory of 1928	1040	backup.exe	41
PID 1928 wrote to memory of 440	1928	backup.exe	42
PID 1928 wrote to memory of 440	1928	backup.exe	42
PID 1928 wrote to memory of 440	1928	backup.exe	42
PID 1928 wrote to memory of 440	1928	backup.exe	42

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe

C:\Users\Admin\AppData\Local\Temp\20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
"C:\Users\Admin\AppData\Local\Temp\20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712
- C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe
  "C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\1644795293\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:968
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:688
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:836
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1084
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1920
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1944
      - C:\Program Files\7-Zip\Lang\data.exe
        
        "C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1392
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1040
      - C:\Program Files\Common Files\Microsoft Shared\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1928
        
        C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:440
        
        C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1244
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1984
        
        C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2012
        
        C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1624
        
        C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
        8⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
        8⤵
        
        PID:2016
        
        C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
        8⤵
        
        PID:1576
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:896
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:824
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:112
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2032
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
        8⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
        8⤵
        
        PID:360
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1360
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
        8⤵
        
        PID:1804
        
        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
        7⤵
        
        PID:1996
        
        C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
        7⤵
        
        PID:108
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:980
      - C:\Program Files\Common Files\SpeechEngines\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1200
      - C:\Program Files\Common Files\System\backup.exe
        
        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:268
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1692
        
        C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:960
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        
        PID:1992
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:112
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:784
        
        C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        
        PID:848
    - - C:\Program Files\DVD Maker\backup.exe
        
        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1752
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1988
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1112
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:572
      - C:\Program Files\DVD Maker\it-IT\data.exe
        
        "C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:976
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        
        PID:1740
      - C:\Program Files\DVD Maker\Shared\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        
        PID:1080
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:900
      - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1688
        
        C:\Program Files\Google\Chrome\Application\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
        9⤵
        
        PID:1756
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
        9⤵
        
        PID:1776
        
        C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
        8⤵
        
        PID:1624
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:672
      - C:\Program Files\Internet Explorer\de-DE\backup.exe
        
        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1364
      - C:\Program Files\Internet Explorer\en-US\data.exe
        
        "C:\Program Files\Internet Explorer\en-US\data.exe" C:\Program Files\Internet Explorer\en-US\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1784
      - C:\Program Files\Internet Explorer\es-ES\backup.exe
        
        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:824
      - C:\Program Files\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
        6⤵
        
        PID:2004
      - C:\Program Files\Internet Explorer\images\backup.exe
        
        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
        6⤵
        
        PID:1800
      - C:\Program Files\Internet Explorer\it-IT\backup.exe
        
        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
        6⤵
        
        PID:1656
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        
        PID:1628
    - - C:\Program Files\Microsoft Games\backup.exe
        
        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:1112
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:964
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:556
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1240
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2000
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        
        PID:592
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        
        PID:1288
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        
        PID:2008
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        
        PID:1280
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        
        PID:1784
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1660
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2044
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\Desktop\backup.exe
        
        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\Documents\backup.exe
        
        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
      - C:\Users\Admin\Downloads\backup.exe
        
        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
        6⤵
        
        PID:1036
      - C:\Users\Admin\Favorites\backup.exe
        
        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
        6⤵
        
        PID:1608
      - C:\Users\Admin\Links\update.exe
        
        C:\Users\Admin\Links\update.exe C:\Users\Admin\Links\
        6⤵
        
        PID:1916
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        
        PID:840
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1900
    - - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1064
    - - C:\Windows\AppCompat\backup.exe
        
        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1036
    - - C:\Windows\AppPatch\System Restore.exe
        
        "C:\Windows\AppPatch\System Restore.exe" C:\Windows\AppPatch\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1788
      - C:\Windows\AppPatch\AppPatch64\backup.exe
        
        C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1492
      - C:\Windows\AppPatch\Custom\backup.exe
        
        C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
        6⤵
        
        PID:1960
      - C:\Windows\AppPatch\de-DE\backup.exe
        
        C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\
        6⤵
        
        PID:1348
      - C:\Windows\AppPatch\en-US\backup.exe
        
        C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
        6⤵
        
        PID:1404
    - - C:\Windows\assembly\backup.exe
        
        C:\Windows\assembly\backup.exe C:\Windows\assembly\
        5⤵
        
        PID:808
      - C:\Windows\assembly\GAC\backup.exe
        
        C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
        6⤵
        
        PID:2024
    - - C:\Windows\Branding\backup.exe
        
        C:\Windows\Branding\backup.exe C:\Windows\Branding\
        5⤵
        
        PID:1364
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1404
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:336
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1372
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:672
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
b2bba64bbd2c59cf57062866c037c54d

SHA1
f3a0aeeae1d074638bfa6eb6869d42227ceca161

SHA256
eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193

SHA512
d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
a9649987cede809582138a81231edc44

SHA1
6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

SHA256
582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

SHA512
f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
a9649987cede809582138a81231edc44

SHA1
6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

SHA256
582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

SHA512
f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
f1e48727987f0884d21a1a2300b8491e

SHA1
505b7818aa30d84833bf03e7d56f7f0b5f456b8c

SHA256
c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4

SHA512
772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb

Download Submit
C:\Program Files\7-Zip\Lang\data.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
33f18b9436f1c71f2af6e975f327115c

SHA1
c02310867b895954b85e4e748d48beca3b2f03bf

SHA256
13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

SHA512
f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
C:\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
d634fa085cde5e91f623643c4c9bf45b

SHA1
8dca033ce4c9baffd7a94ef05dc0cf04bb500e12

SHA256
971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d

SHA512
41586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
C:\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
dee18dd1bade284a420b72462ed970c5

SHA1
05fb9544d0c416fee8ab962bf99b38511bc923af

SHA256
c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960

SHA512
c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
665c8b8832e0c83c39633155bfbaea77

SHA1
e6977529e69df9afa187434abb7b4e2d371e60d5

SHA256
35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

SHA512
16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
665c8b8832e0c83c39633155bfbaea77

SHA1
e6977529e69df9afa187434abb7b4e2d371e60d5

SHA256
35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

SHA512
16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

Download Submit
C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
C:\backup.exe

Filesize
72KB

MD5
cd32f587821c58e3146923e96265f92e

SHA1
a3cf848769f729a675ea20ba4b0d0fe6ada44b94

SHA256
8bf7399e01496cbba55133d038941bf148b397f823effe9298b964d58ed60e84

SHA512
69c484c5f06a8777f42cc1f9c9f30ac5bc1a64b401b47b0e702ecd9be67f8d757de8cb40e92470aeebfeb38cda823920c888a732429ac85c0a66c6569b7c7aa2

Download Submit
C:\backup.exe

Filesize
72KB

MD5
cd32f587821c58e3146923e96265f92e

SHA1
a3cf848769f729a675ea20ba4b0d0fe6ada44b94

SHA256
8bf7399e01496cbba55133d038941bf148b397f823effe9298b964d58ed60e84

SHA512
69c484c5f06a8777f42cc1f9c9f30ac5bc1a64b401b47b0e702ecd9be67f8d757de8cb40e92470aeebfeb38cda823920c888a732429ac85c0a66c6569b7c7aa2

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
b2bba64bbd2c59cf57062866c037c54d

SHA1
f3a0aeeae1d074638bfa6eb6869d42227ceca161

SHA256
eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193

SHA512
d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
b2bba64bbd2c59cf57062866c037c54d

SHA1
f3a0aeeae1d074638bfa6eb6869d42227ceca161

SHA256
eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193

SHA512
d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
a9649987cede809582138a81231edc44

SHA1
6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

SHA256
582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

SHA512
f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
a9649987cede809582138a81231edc44

SHA1
6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

SHA256
582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

SHA512
f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
f1e48727987f0884d21a1a2300b8491e

SHA1
505b7818aa30d84833bf03e7d56f7f0b5f456b8c

SHA256
c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4

SHA512
772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
f1e48727987f0884d21a1a2300b8491e

SHA1
505b7818aa30d84833bf03e7d56f7f0b5f456b8c

SHA256
c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4

SHA512
772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb

Download Submit
\Program Files\7-Zip\Lang\data.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
\Program Files\7-Zip\Lang\data.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
33f18b9436f1c71f2af6e975f327115c

SHA1
c02310867b895954b85e4e748d48beca3b2f03bf

SHA256
13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

SHA512
f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
33f18b9436f1c71f2af6e975f327115c

SHA1
c02310867b895954b85e4e748d48beca3b2f03bf

SHA256
13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

SHA512
f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
a28a15c096fe78cb2d53a00ae142ed59

SHA1
5d54e19d4bf0e3a277ff29fd17f4550282839c62

SHA256
2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

SHA512
1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
33f18b9436f1c71f2af6e975f327115c

SHA1
c02310867b895954b85e4e748d48beca3b2f03bf

SHA256
13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

SHA512
f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
33f18b9436f1c71f2af6e975f327115c

SHA1
c02310867b895954b85e4e748d48beca3b2f03bf

SHA256
13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

SHA512
f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

Download Submit
\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
d634fa085cde5e91f623643c4c9bf45b

SHA1
8dca033ce4c9baffd7a94ef05dc0cf04bb500e12

SHA256
971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d

SHA512
41586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa

Download Submit
\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
d634fa085cde5e91f623643c4c9bf45b

SHA1
8dca033ce4c9baffd7a94ef05dc0cf04bb500e12

SHA256
971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d

SHA512
41586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
7a95b97eae5d7288c02e87ed03902d03

SHA1
4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

SHA256
9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

SHA512
e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
dee18dd1bade284a420b72462ed970c5

SHA1
05fb9544d0c416fee8ab962bf99b38511bc923af

SHA256
c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960

SHA512
c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
dee18dd1bade284a420b72462ed970c5

SHA1
05fb9544d0c416fee8ab962bf99b38511bc923af

SHA256
c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960

SHA512
c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
665c8b8832e0c83c39633155bfbaea77

SHA1
e6977529e69df9afa187434abb7b4e2d371e60d5

SHA256
35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

SHA512
16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
665c8b8832e0c83c39633155bfbaea77

SHA1
e6977529e69df9afa187434abb7b4e2d371e60d5

SHA256
35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

SHA512
16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

Download Submit
\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
657b2093b71955e34a599b7a6eb9d6cc

SHA1
e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

SHA256
7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

SHA512
099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
f4b2f128bc0fd1d155baa5380ee5c0ab

SHA1
117d848bd407485aff8d2057d5cfad3e422b7aaa

SHA256
6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

SHA512
261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

Download Submit
memory/1712-190-0x0000000074021000-0x0000000074023000-memory.dmp

Filesize
8KB

Download
memory/1712-117-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads