Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:20
Static task
static1
Behavioral task
behavioral1
Sample
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe
Resource
win10v2004-20220901-en
General
-
Target
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe
-
Size
72KB
-
MD5
5eee4bd99c5d91f09b88f69350efbb5f
-
SHA1
3b43113060a036e6ff7e556849314b9e04c41547
-
SHA256
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db
-
SHA512
e81e9b275f6ab2d5488d432f5465f8a17ac2c8d717d0538a5869808a16031d28cec1d8612598d634edcb4eaaa3bf0b50128b54130328054fe94fe0fa3eed9779
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2m:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrK
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exeupdate.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
Processes:
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exepid process 2044 backup.exe 1452 backup.exe 1504 backup.exe 1600 backup.exe 1548 backup.exe 952 backup.exe 1364 backup.exe 1584 backup.exe 1128 backup.exe 800 backup.exe 1244 backup.exe 1980 System Restore.exe 1720 backup.exe 1376 backup.exe 1736 backup.exe 1368 backup.exe 1764 data.exe 1080 backup.exe 1620 backup.exe 1352 backup.exe 864 backup.exe 1792 backup.exe 1684 backup.exe 1728 backup.exe 1600 backup.exe 912 backup.exe 320 backup.exe 524 backup.exe 1364 data.exe 368 backup.exe 692 backup.exe 1296 backup.exe 760 backup.exe 1656 backup.exe 1508 backup.exe 1456 backup.exe 1180 backup.exe 1124 backup.exe 1084 System Restore.exe 856 backup.exe 836 backup.exe 1468 backup.exe 1164 backup.exe 1556 backup.exe 1176 backup.exe 1884 backup.exe 1596 backup.exe 1620 backup.exe 2000 backup.exe 1532 backup.exe 1088 backup.exe 1652 backup.exe 1540 backup.exe 972 backup.exe 920 backup.exe 680 backup.exe 584 backup.exe 1860 backup.exe 548 backup.exe 964 data.exe 1320 backup.exe 472 backup.exe 1448 backup.exe 772 backup.exe -
Loads dropped DLL 64 IoCs
Processes:
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exedata.exedata.exepid process 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 952 backup.exe 952 backup.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 1584 backup.exe 1584 backup.exe 952 backup.exe 952 backup.exe 1244 backup.exe 1244 backup.exe 1980 System Restore.exe 1980 System Restore.exe 1244 backup.exe 1244 backup.exe 1376 backup.exe 1376 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1764 data.exe 1364 data.exe 1364 data.exe 1364 data.exe 1364 data.exe 1364 data.exe 1364 data.exe 1364 data.exe 1364 data.exe -
Drops file in Program Files directory 64 IoCs
Processes:
backup.exedata.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exedescription ioc process File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe System Restore.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe backup.exe File opened for modification C:\Program Files\Java\jre7\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe System Restore.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe System Restore.exe File opened for modification C:\Program Files\MSBuild\backup.exe backup.exe File opened for modification C:\Program Files\Reference Assemblies\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe backup.exe -
Drops file in Windows directory 8 IoCs
Processes:
backup.exebackup.exedescription ioc process File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe File opened for modification C:\Windows\CSC\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\System Restore.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exepid process 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exepid process 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe 2044 backup.exe 1452 backup.exe 1504 backup.exe 1600 backup.exe 1548 backup.exe 952 backup.exe 1364 backup.exe 1584 backup.exe 1128 backup.exe 800 backup.exe 1244 backup.exe 1980 System Restore.exe 1720 backup.exe 1376 backup.exe 1736 backup.exe 1368 backup.exe 1764 data.exe 1080 backup.exe 1620 backup.exe 1352 backup.exe 864 backup.exe 1792 backup.exe 1684 backup.exe 1728 backup.exe 1600 backup.exe 912 backup.exe 320 backup.exe 524 backup.exe 1364 data.exe 368 backup.exe 692 backup.exe 1296 backup.exe 760 backup.exe 1656 backup.exe 1508 backup.exe 1456 backup.exe 1180 backup.exe 1124 backup.exe 1084 System Restore.exe 856 backup.exe 836 backup.exe 1468 backup.exe 1164 backup.exe 1556 backup.exe 1176 backup.exe 1884 backup.exe 1596 backup.exe 1620 backup.exe 2000 backup.exe 1532 backup.exe 1088 backup.exe 1652 backup.exe 1540 backup.exe 972 backup.exe 920 backup.exe 680 backup.exe 584 backup.exe 1860 backup.exe 548 backup.exe 964 data.exe 1320 backup.exe 472 backup.exe 1448 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exedescription pid process target process PID 1872 wrote to memory of 2044 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 2044 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 2044 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 2044 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1452 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1452 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1452 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1452 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1504 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1504 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1504 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1504 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1600 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1600 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1600 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1600 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1548 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1548 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1548 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1548 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 2044 wrote to memory of 952 2044 backup.exe backup.exe PID 2044 wrote to memory of 952 2044 backup.exe backup.exe PID 2044 wrote to memory of 952 2044 backup.exe backup.exe PID 2044 wrote to memory of 952 2044 backup.exe backup.exe PID 1872 wrote to memory of 1364 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1364 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1364 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1364 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 952 wrote to memory of 1584 952 backup.exe backup.exe PID 952 wrote to memory of 1584 952 backup.exe backup.exe PID 952 wrote to memory of 1584 952 backup.exe backup.exe PID 952 wrote to memory of 1584 952 backup.exe backup.exe PID 1872 wrote to memory of 1128 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1128 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1128 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1872 wrote to memory of 1128 1872 a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe backup.exe PID 1584 wrote to memory of 800 1584 backup.exe backup.exe PID 1584 wrote to memory of 800 1584 backup.exe backup.exe PID 1584 wrote to memory of 800 1584 backup.exe backup.exe PID 1584 wrote to memory of 800 1584 backup.exe backup.exe PID 952 wrote to memory of 1244 952 backup.exe backup.exe PID 952 wrote to memory of 1244 952 backup.exe backup.exe PID 952 wrote to memory of 1244 952 backup.exe backup.exe PID 952 wrote to memory of 1244 952 backup.exe backup.exe PID 1244 wrote to memory of 1980 1244 backup.exe System Restore.exe PID 1244 wrote to memory of 1980 1244 backup.exe System Restore.exe PID 1244 wrote to memory of 1980 1244 backup.exe System Restore.exe PID 1244 wrote to memory of 1980 1244 backup.exe System Restore.exe PID 1980 wrote to memory of 1720 1980 System Restore.exe backup.exe PID 1980 wrote to memory of 1720 1980 System Restore.exe backup.exe PID 1980 wrote to memory of 1720 1980 System Restore.exe backup.exe PID 1980 wrote to memory of 1720 1980 System Restore.exe backup.exe PID 1244 wrote to memory of 1376 1244 backup.exe backup.exe PID 1244 wrote to memory of 1376 1244 backup.exe backup.exe PID 1244 wrote to memory of 1376 1244 backup.exe backup.exe PID 1244 wrote to memory of 1376 1244 backup.exe backup.exe PID 1376 wrote to memory of 1736 1376 backup.exe backup.exe PID 1376 wrote to memory of 1736 1376 backup.exe backup.exe PID 1376 wrote to memory of 1736 1376 backup.exe backup.exe PID 1376 wrote to memory of 1736 1376 backup.exe backup.exe PID 1736 wrote to memory of 1368 1736 backup.exe backup.exe PID 1736 wrote to memory of 1368 1736 backup.exe backup.exe PID 1736 wrote to memory of 1368 1736 backup.exe backup.exe PID 1736 wrote to memory of 1368 1736 backup.exe backup.exe -
System policy modification 1 TTPs 64 IoCs
Processes:
backup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exea9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe"C:\Users\Admin\AppData\Local\Temp\a9ebaba30531980662b1843d674985a530467f2491128c5e2dcc3a5393d5a1db.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3863344191\backup.exeC:\Users\Admin\AppData\Local\Temp\3863344191\backup.exe C:\Users\Admin\AppData\Local\Temp\3863344191\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:952 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:800 -
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files\7-Zip\System Restore.exe"C:\Program Files\7-Zip\System Restore.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1980 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720 -
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1368 -
C:\Program Files\Common Files\Microsoft Shared\ink\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1764 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1080 -
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620 -
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352 -
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:864 -
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684 -
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728 -
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600 -
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:912 -
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320 -
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:524 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:368 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:692 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1296 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1508 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1180 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1124 -
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:856 -
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:836 -
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468 -
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164 -
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556 -
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176 -
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1884 -
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1596 -
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620 -
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000 -
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532 -
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088 -
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:920 -
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680 -
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584 -
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1860 -
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548 -
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:964 -
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1320 -
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:472 -
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:772 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1400 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:924
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Disables RegEdit via registry modification
PID:1696 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
PID:1104 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:1328 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:756
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:564 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Disables RegEdit via registry modification
PID:836 -
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1628
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\update.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\update.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
PID:900 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1680 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1976
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1640 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:2004
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:2040
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1596
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:1748 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\data.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1612 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:912 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1860 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:976
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- System policy modification
PID:800 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1400 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:1696
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:828 -
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:836 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1468 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- System policy modification
PID:1960 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1708 -
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
PID:332 -
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:320
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1028 -
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:964 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1584 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2008 -
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:556 -
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1828 -
C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe"C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- System policy modification
PID:1472 -
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1944
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:1640 -
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:1744 -
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Disables RegEdit via registry modification
PID:1748 -
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1724
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
PID:1700 -
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- System policy modification
PID:1808 -
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1860 -
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:588 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- System policy modification
PID:1296 -
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵PID:1600
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1212 -
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1400 -
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- Disables RegEdit via registry modification
PID:2032 -
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:1672
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:828 -
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:1168
-
C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe"C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵PID:1540
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵PID:1320
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵PID:840
-
C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵PID:1376
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\8⤵PID:1128
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1684 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- System policy modification
PID:1700 -
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
PID:1600 -
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Disables RegEdit via registry modification
PID:1756 -
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
PID:1492 -
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:812 -
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1164 -
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
PID:1892 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1080 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1452 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1680
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Modifies visibility of file extensions in Explorer
PID:1540 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:332
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:912 -
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1028
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:544
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- Disables RegEdit via registry modification
PID:1584 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1452
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:1360
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:1176
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:1448
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:832
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:2060
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1456 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
PID:1612 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:788 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- System policy modification
PID:1164 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:1680
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:976
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1576
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:588
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:1728
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:2068
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1628
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1748
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:900
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
PID:1596 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:692
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:1492
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1336
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:472
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1656
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:548
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:1328
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2104
-
C:\Program Files (x86)\System Restore.exe"C:\Program Files (x86)\System Restore.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
PID:1692 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- System policy modification
PID:1356 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1336 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵PID:668
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1980
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1600
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1612
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1800
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1484
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:2036
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Disables RegEdit via registry modification
PID:1732 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1892
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1808
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1792
-
C:\Program Files (x86)\Common Files\microsoft shared\update.exe"C:\Program Files (x86)\Common Files\microsoft shared\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2112
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:812
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1620
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1704
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:680
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:836
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1204
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:564
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:1744
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
PID:1448 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1224
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:572
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1356
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:632
-
C:\Users\Admin\Downloads\data.exeC:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\6⤵PID:1964
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1956
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
PID:1944 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1528
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1764
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:624
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:952
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵PID:1540
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵PID:2052
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
- System policy modification
PID:860 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:2040
-
C:\Windows\AppCompat\System Restore.exe"C:\Windows\AppCompat\System Restore.exe" C:\Windows\AppCompat\5⤵PID:1816
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1072
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1532
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:1060
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\Admin\backup.exeFilesize
72KB
MD545ba9459011533c1e6fa247207b6a573
SHA16d8fa9e65145a4a646c8a202c3a179827ac5ed92
SHA256c0daec929593e7141dd790fb1f964247ed17d6c03313e14cf639c7afe3f22063
SHA5121cdaf61d1776757d8683e92378550a27423eb7145971969ded7273dece08e040bdb3700b42b14805a46bd5534bf83d2b87e7e46dce7f09ba106d532df5103806
-
C:\PerfLogs\backup.exeFilesize
72KB
MD5bec7d64276227b275fb07f3d8b27aa15
SHA184cbbb6e21f595ac43dfd1d2ad1061076fe880ff
SHA2561da5c3b2d76129223ee1f52f9c70d919621a5a2c8617dd3a3d96d72166685006
SHA512c0ff76678e8860301d049fdcb98c94be418e1e86f4fbff4db09f702106c4ea37e4cf1d8ff9538251ac6f64db8cd59d2152accac9209cfa7b29e4bdfc78da601c
-
C:\PerfLogs\backup.exeFilesize
72KB
MD5bec7d64276227b275fb07f3d8b27aa15
SHA184cbbb6e21f595ac43dfd1d2ad1061076fe880ff
SHA2561da5c3b2d76129223ee1f52f9c70d919621a5a2c8617dd3a3d96d72166685006
SHA512c0ff76678e8860301d049fdcb98c94be418e1e86f4fbff4db09f702106c4ea37e4cf1d8ff9538251ac6f64db8cd59d2152accac9209cfa7b29e4bdfc78da601c
-
C:\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
C:\Program Files\7-Zip\System Restore.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
C:\Program Files\7-Zip\System Restore.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD58ba481b34b7f56309229702fc4b0d2f6
SHA1ad604482a229560ec3fdba79e5fa4c3e964a2564
SHA2560745cf0ba8d67ec8b651df2523000bb65ee50c391b130fed6716055187fafdfc
SHA5123b5f10d87f8468bebe4e5df502c914a4ac55caf668c399e41ad9e3a71b7a95ce9071b69e726371b327f5c94f3c0edb244d957a1001d791c8c8615a81e6dfd283
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD54eea9a7dddc4ddce0709e7823600c5be
SHA1f5a43ea161b532019edfb8aa9115010d3564a61f
SHA2566b1a7b2fa256d68a579290000b5cbae706b56cd84693ec7071e843d4a5c33c0c
SHA512ef892205a773fd3ac8771d4a4447acfd5b6dd4f79bcb4d1ff74b8e89b7adb7063918cc5b2da35c47e2d5be506271d3242ea457d00dbcfda0cff170f952b3c316
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD54eea9a7dddc4ddce0709e7823600c5be
SHA1f5a43ea161b532019edfb8aa9115010d3564a61f
SHA2566b1a7b2fa256d68a579290000b5cbae706b56cd84693ec7071e843d4a5c33c0c
SHA512ef892205a773fd3ac8771d4a4447acfd5b6dd4f79bcb4d1ff74b8e89b7adb7063918cc5b2da35c47e2d5be506271d3242ea457d00dbcfda0cff170f952b3c316
-
C:\Program Files\Common Files\Microsoft Shared\ink\data.exeFilesize
72KB
MD575a9a258e63068a094e210b767542b74
SHA1f360cfcbde2b10d517aec2346037b9527e9d9b89
SHA256a7862afef1c357a1713866ce96af83414edd337f8c25c8381a843cb9e1671fe7
SHA5126551249c7fdb920c58f8265c0a3590034044c79fecffecd74618163fac8210efd3e939e9aaebae10171879477ffdc6c6ea5ef267db96cf82b4724999cb3cb3ae
-
C:\Program Files\Common Files\Microsoft Shared\ink\data.exeFilesize
72KB
MD575a9a258e63068a094e210b767542b74
SHA1f360cfcbde2b10d517aec2346037b9527e9d9b89
SHA256a7862afef1c357a1713866ce96af83414edd337f8c25c8381a843cb9e1671fe7
SHA5126551249c7fdb920c58f8265c0a3590034044c79fecffecd74618163fac8210efd3e939e9aaebae10171879477ffdc6c6ea5ef267db96cf82b4724999cb3cb3ae
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
C:\Program Files\backup.exeFilesize
72KB
MD5d4645e38646edc4d33a6b69dfb821438
SHA19c959fda6c0bcd9eb5086880f5079e380bcdd233
SHA25609c46cec81d802aa7e84a544511662d40f0bb9b31b0080b5f57aca66591b485c
SHA512bb3120e0919fc7c2cffc864655c7dc26f9d52a12e6ffc370489f4a15a80d001ecb2a87731381a394283fd6a1a734b177faa44bc1901afff36f8383404330bdee
-
C:\Program Files\backup.exeFilesize
72KB
MD5d4645e38646edc4d33a6b69dfb821438
SHA19c959fda6c0bcd9eb5086880f5079e380bcdd233
SHA25609c46cec81d802aa7e84a544511662d40f0bb9b31b0080b5f57aca66591b485c
SHA512bb3120e0919fc7c2cffc864655c7dc26f9d52a12e6ffc370489f4a15a80d001ecb2a87731381a394283fd6a1a734b177faa44bc1901afff36f8383404330bdee
-
C:\Users\Admin\AppData\Local\Temp\3863344191\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
C:\Users\Admin\AppData\Local\Temp\3863344191\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5e821d52b11b144270c7e8b31ec7c09a3
SHA14b65b1f74817ecdab0ee4f983a5271decb4f9aaa
SHA256eb9932fa77d36003a05fabeed073acecbbc541367b9e0ed52e6cc877c1a68859
SHA512fa1e91d426d4e7075b58c4bae59057397f6ee49710512821666b6bf12b9588c5ff7f0ee269ce630351f8d32a83dd0de1431f18fb76d1e3ac2850d8caea113023
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5e821d52b11b144270c7e8b31ec7c09a3
SHA14b65b1f74817ecdab0ee4f983a5271decb4f9aaa
SHA256eb9932fa77d36003a05fabeed073acecbbc541367b9e0ed52e6cc877c1a68859
SHA512fa1e91d426d4e7075b58c4bae59057397f6ee49710512821666b6bf12b9588c5ff7f0ee269ce630351f8d32a83dd0de1431f18fb76d1e3ac2850d8caea113023
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD580d48063dfe51ed0ae44bccdd552d178
SHA19c8d92a39b08fa336cc4ba3fd3dde85f9ac34eb8
SHA2566bb6cf82e96b11396abd8e0b4c025a37cf97a95cdac8cbf2aabdb9c0365846e6
SHA5125a603115afcf35d8f8941c924c38b0bafd69ac28e1363fa888d3e01b6f411d8ce298fe13c54da5b5a78457730012f73c530b84d911f14d7fb7597632568e13a6
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD553bb7bc1df4deb210930b1b505931709
SHA1ad33ce2aa892eb6b15a5d0da68a1fbf8c557909d
SHA2567c500a80b2701b909fab47e4e60d5b4454ad09df801d9441debf98a78611637e
SHA512bad381dae6ab45c45270135312e1d2603ed56b4a1d45464425072283703c7d67a2ce75f67ea8ca3a78682b1da0abb2e4edfb78b255d7dbe699d6a4a20219a1f2
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD580d48063dfe51ed0ae44bccdd552d178
SHA19c8d92a39b08fa336cc4ba3fd3dde85f9ac34eb8
SHA2566bb6cf82e96b11396abd8e0b4c025a37cf97a95cdac8cbf2aabdb9c0365846e6
SHA5125a603115afcf35d8f8941c924c38b0bafd69ac28e1363fa888d3e01b6f411d8ce298fe13c54da5b5a78457730012f73c530b84d911f14d7fb7597632568e13a6
-
C:\backup.exeFilesize
72KB
MD5557dcb1fd9f7fa08f6e5ff3fce9e3f1c
SHA16145aa41e01ca513b6b34539dcefae8558c80573
SHA256bb4b7cc93120b997ee185189226f0e20d609bc01dee0899dea3a236c22d2b673
SHA5122cae5c50347f31363ac03c5bef87ef1aa93d59e2a8cb460395e32381a99ff3c1d414e8b7bc3e2732438ab1a0f1d3911cb99cdf65d94cffec2c39dc49ea897c0c
-
C:\backup.exeFilesize
72KB
MD5557dcb1fd9f7fa08f6e5ff3fce9e3f1c
SHA16145aa41e01ca513b6b34539dcefae8558c80573
SHA256bb4b7cc93120b997ee185189226f0e20d609bc01dee0899dea3a236c22d2b673
SHA5122cae5c50347f31363ac03c5bef87ef1aa93d59e2a8cb460395e32381a99ff3c1d414e8b7bc3e2732438ab1a0f1d3911cb99cdf65d94cffec2c39dc49ea897c0c
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD545ba9459011533c1e6fa247207b6a573
SHA16d8fa9e65145a4a646c8a202c3a179827ac5ed92
SHA256c0daec929593e7141dd790fb1f964247ed17d6c03313e14cf639c7afe3f22063
SHA5121cdaf61d1776757d8683e92378550a27423eb7145971969ded7273dece08e040bdb3700b42b14805a46bd5534bf83d2b87e7e46dce7f09ba106d532df5103806
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD545ba9459011533c1e6fa247207b6a573
SHA16d8fa9e65145a4a646c8a202c3a179827ac5ed92
SHA256c0daec929593e7141dd790fb1f964247ed17d6c03313e14cf639c7afe3f22063
SHA5121cdaf61d1776757d8683e92378550a27423eb7145971969ded7273dece08e040bdb3700b42b14805a46bd5534bf83d2b87e7e46dce7f09ba106d532df5103806
-
\PerfLogs\backup.exeFilesize
72KB
MD5bec7d64276227b275fb07f3d8b27aa15
SHA184cbbb6e21f595ac43dfd1d2ad1061076fe880ff
SHA2561da5c3b2d76129223ee1f52f9c70d919621a5a2c8617dd3a3d96d72166685006
SHA512c0ff76678e8860301d049fdcb98c94be418e1e86f4fbff4db09f702106c4ea37e4cf1d8ff9538251ac6f64db8cd59d2152accac9209cfa7b29e4bdfc78da601c
-
\PerfLogs\backup.exeFilesize
72KB
MD5bec7d64276227b275fb07f3d8b27aa15
SHA184cbbb6e21f595ac43dfd1d2ad1061076fe880ff
SHA2561da5c3b2d76129223ee1f52f9c70d919621a5a2c8617dd3a3d96d72166685006
SHA512c0ff76678e8860301d049fdcb98c94be418e1e86f4fbff4db09f702106c4ea37e4cf1d8ff9538251ac6f64db8cd59d2152accac9209cfa7b29e4bdfc78da601c
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
\Program Files\7-Zip\System Restore.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
\Program Files\7-Zip\System Restore.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD58ba481b34b7f56309229702fc4b0d2f6
SHA1ad604482a229560ec3fdba79e5fa4c3e964a2564
SHA2560745cf0ba8d67ec8b651df2523000bb65ee50c391b130fed6716055187fafdfc
SHA5123b5f10d87f8468bebe4e5df502c914a4ac55caf668c399e41ad9e3a71b7a95ce9071b69e726371b327f5c94f3c0edb244d957a1001d791c8c8615a81e6dfd283
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD58ba481b34b7f56309229702fc4b0d2f6
SHA1ad604482a229560ec3fdba79e5fa4c3e964a2564
SHA2560745cf0ba8d67ec8b651df2523000bb65ee50c391b130fed6716055187fafdfc
SHA5123b5f10d87f8468bebe4e5df502c914a4ac55caf668c399e41ad9e3a71b7a95ce9071b69e726371b327f5c94f3c0edb244d957a1001d791c8c8615a81e6dfd283
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5101e60445a33bbc136fcadeeba04d1f9
SHA1082d8079c76e534558fc08009dab537efe176432
SHA256a6686374eba219503be5fd66a9efe818c576d559043bb930483b5b895c2ce814
SHA5121e8ebf6f03bd53e5eb9848df3f319d38ab16bd92aabe9ce20da43dbe1c381cae53410cf84674e857f5a85a896fe91856280737114f99cb0063a7c6ce21c17cce
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD54eea9a7dddc4ddce0709e7823600c5be
SHA1f5a43ea161b532019edfb8aa9115010d3564a61f
SHA2566b1a7b2fa256d68a579290000b5cbae706b56cd84693ec7071e843d4a5c33c0c
SHA512ef892205a773fd3ac8771d4a4447acfd5b6dd4f79bcb4d1ff74b8e89b7adb7063918cc5b2da35c47e2d5be506271d3242ea457d00dbcfda0cff170f952b3c316
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD54eea9a7dddc4ddce0709e7823600c5be
SHA1f5a43ea161b532019edfb8aa9115010d3564a61f
SHA2566b1a7b2fa256d68a579290000b5cbae706b56cd84693ec7071e843d4a5c33c0c
SHA512ef892205a773fd3ac8771d4a4447acfd5b6dd4f79bcb4d1ff74b8e89b7adb7063918cc5b2da35c47e2d5be506271d3242ea457d00dbcfda0cff170f952b3c316
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD54eea9a7dddc4ddce0709e7823600c5be
SHA1f5a43ea161b532019edfb8aa9115010d3564a61f
SHA2566b1a7b2fa256d68a579290000b5cbae706b56cd84693ec7071e843d4a5c33c0c
SHA512ef892205a773fd3ac8771d4a4447acfd5b6dd4f79bcb4d1ff74b8e89b7adb7063918cc5b2da35c47e2d5be506271d3242ea457d00dbcfda0cff170f952b3c316
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD54eea9a7dddc4ddce0709e7823600c5be
SHA1f5a43ea161b532019edfb8aa9115010d3564a61f
SHA2566b1a7b2fa256d68a579290000b5cbae706b56cd84693ec7071e843d4a5c33c0c
SHA512ef892205a773fd3ac8771d4a4447acfd5b6dd4f79bcb4d1ff74b8e89b7adb7063918cc5b2da35c47e2d5be506271d3242ea457d00dbcfda0cff170f952b3c316
-
\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exeFilesize
72KB
MD5596a97e5bdc5d73461685feb76c626b9
SHA1242cb73dd1c22a15c05b79acbe3fb6f31fa69749
SHA2561dedfed1f6995c81c631d4d3d7f3101175877321916bd7dba0560e2899532dd1
SHA51286200f241d6d79a8575d4e9dddd877f90c926a43d421ee1696ec5cbeccb0bb83438ca59ca25643106614cb25656148c07313f23813ed2985583615f4f4c70bc2
-
\Program Files\Common Files\Microsoft Shared\ink\data.exeFilesize
72KB
MD575a9a258e63068a094e210b767542b74
SHA1f360cfcbde2b10d517aec2346037b9527e9d9b89
SHA256a7862afef1c357a1713866ce96af83414edd337f8c25c8381a843cb9e1671fe7
SHA5126551249c7fdb920c58f8265c0a3590034044c79fecffecd74618163fac8210efd3e939e9aaebae10171879477ffdc6c6ea5ef267db96cf82b4724999cb3cb3ae
-
\Program Files\Common Files\Microsoft Shared\ink\data.exeFilesize
72KB
MD575a9a258e63068a094e210b767542b74
SHA1f360cfcbde2b10d517aec2346037b9527e9d9b89
SHA256a7862afef1c357a1713866ce96af83414edd337f8c25c8381a843cb9e1671fe7
SHA5126551249c7fdb920c58f8265c0a3590034044c79fecffecd74618163fac8210efd3e939e9aaebae10171879477ffdc6c6ea5ef267db96cf82b4724999cb3cb3ae
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5ebdd90fa7322cda69daced76a6d47ace
SHA1558d3118e1b41e23723cf7822b766d38d10afb94
SHA256e5952ee01e955bb37cc143f217865f787ad43c0669368d316209ef52acebdab3
SHA5124b9580a8d24ff9bf6e0c05d1f76df484f8e0fe0616ed01800069f8b95c1ee3e5b3d8fda43a1b48e3fff615cea06dac3848654514d274c093b082c9c666a9b542
-
\Program Files\backup.exeFilesize
72KB
MD5d4645e38646edc4d33a6b69dfb821438
SHA19c959fda6c0bcd9eb5086880f5079e380bcdd233
SHA25609c46cec81d802aa7e84a544511662d40f0bb9b31b0080b5f57aca66591b485c
SHA512bb3120e0919fc7c2cffc864655c7dc26f9d52a12e6ffc370489f4a15a80d001ecb2a87731381a394283fd6a1a734b177faa44bc1901afff36f8383404330bdee
-
\Program Files\backup.exeFilesize
72KB
MD5d4645e38646edc4d33a6b69dfb821438
SHA19c959fda6c0bcd9eb5086880f5079e380bcdd233
SHA25609c46cec81d802aa7e84a544511662d40f0bb9b31b0080b5f57aca66591b485c
SHA512bb3120e0919fc7c2cffc864655c7dc26f9d52a12e6ffc370489f4a15a80d001ecb2a87731381a394283fd6a1a734b177faa44bc1901afff36f8383404330bdee
-
\Users\Admin\AppData\Local\Temp\3863344191\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
\Users\Admin\AppData\Local\Temp\3863344191\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5e821d52b11b144270c7e8b31ec7c09a3
SHA14b65b1f74817ecdab0ee4f983a5271decb4f9aaa
SHA256eb9932fa77d36003a05fabeed073acecbbc541367b9e0ed52e6cc877c1a68859
SHA512fa1e91d426d4e7075b58c4bae59057397f6ee49710512821666b6bf12b9588c5ff7f0ee269ce630351f8d32a83dd0de1431f18fb76d1e3ac2850d8caea113023
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5e821d52b11b144270c7e8b31ec7c09a3
SHA14b65b1f74817ecdab0ee4f983a5271decb4f9aaa
SHA256eb9932fa77d36003a05fabeed073acecbbc541367b9e0ed52e6cc877c1a68859
SHA512fa1e91d426d4e7075b58c4bae59057397f6ee49710512821666b6bf12b9588c5ff7f0ee269ce630351f8d32a83dd0de1431f18fb76d1e3ac2850d8caea113023
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5e821d52b11b144270c7e8b31ec7c09a3
SHA14b65b1f74817ecdab0ee4f983a5271decb4f9aaa
SHA256eb9932fa77d36003a05fabeed073acecbbc541367b9e0ed52e6cc877c1a68859
SHA512fa1e91d426d4e7075b58c4bae59057397f6ee49710512821666b6bf12b9588c5ff7f0ee269ce630351f8d32a83dd0de1431f18fb76d1e3ac2850d8caea113023
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5e821d52b11b144270c7e8b31ec7c09a3
SHA14b65b1f74817ecdab0ee4f983a5271decb4f9aaa
SHA256eb9932fa77d36003a05fabeed073acecbbc541367b9e0ed52e6cc877c1a68859
SHA512fa1e91d426d4e7075b58c4bae59057397f6ee49710512821666b6bf12b9588c5ff7f0ee269ce630351f8d32a83dd0de1431f18fb76d1e3ac2850d8caea113023
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD580d48063dfe51ed0ae44bccdd552d178
SHA19c8d92a39b08fa336cc4ba3fd3dde85f9ac34eb8
SHA2566bb6cf82e96b11396abd8e0b4c025a37cf97a95cdac8cbf2aabdb9c0365846e6
SHA5125a603115afcf35d8f8941c924c38b0bafd69ac28e1363fa888d3e01b6f411d8ce298fe13c54da5b5a78457730012f73c530b84d911f14d7fb7597632568e13a6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD580d48063dfe51ed0ae44bccdd552d178
SHA19c8d92a39b08fa336cc4ba3fd3dde85f9ac34eb8
SHA2566bb6cf82e96b11396abd8e0b4c025a37cf97a95cdac8cbf2aabdb9c0365846e6
SHA5125a603115afcf35d8f8941c924c38b0bafd69ac28e1363fa888d3e01b6f411d8ce298fe13c54da5b5a78457730012f73c530b84d911f14d7fb7597632568e13a6
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD553bb7bc1df4deb210930b1b505931709
SHA1ad33ce2aa892eb6b15a5d0da68a1fbf8c557909d
SHA2567c500a80b2701b909fab47e4e60d5b4454ad09df801d9441debf98a78611637e
SHA512bad381dae6ab45c45270135312e1d2603ed56b4a1d45464425072283703c7d67a2ce75f67ea8ca3a78682b1da0abb2e4edfb78b255d7dbe699d6a4a20219a1f2
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD553bb7bc1df4deb210930b1b505931709
SHA1ad33ce2aa892eb6b15a5d0da68a1fbf8c557909d
SHA2567c500a80b2701b909fab47e4e60d5b4454ad09df801d9441debf98a78611637e
SHA512bad381dae6ab45c45270135312e1d2603ed56b4a1d45464425072283703c7d67a2ce75f67ea8ca3a78682b1da0abb2e4edfb78b255d7dbe699d6a4a20219a1f2
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD59cbfcb1ea0f035054e9d965054759d2f
SHA1f90dbed704cccb0b150ee8829403be4c36f3e24e
SHA256f946f0ea8df5ee4d11cf07e62b9bceb32661989f8c2126a04018aa4e55720b11
SHA5124cfbc85b1c1563f29bb675ae47311268d8553cea566935f05e0ad32b7aa42316526eac232e9b2b6bab820c6c746c4eb21fcedb7fae18e839b99af6f1cad86ce5
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD580d48063dfe51ed0ae44bccdd552d178
SHA19c8d92a39b08fa336cc4ba3fd3dde85f9ac34eb8
SHA2566bb6cf82e96b11396abd8e0b4c025a37cf97a95cdac8cbf2aabdb9c0365846e6
SHA5125a603115afcf35d8f8941c924c38b0bafd69ac28e1363fa888d3e01b6f411d8ce298fe13c54da5b5a78457730012f73c530b84d911f14d7fb7597632568e13a6
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD580d48063dfe51ed0ae44bccdd552d178
SHA19c8d92a39b08fa336cc4ba3fd3dde85f9ac34eb8
SHA2566bb6cf82e96b11396abd8e0b4c025a37cf97a95cdac8cbf2aabdb9c0365846e6
SHA5125a603115afcf35d8f8941c924c38b0bafd69ac28e1363fa888d3e01b6f411d8ce298fe13c54da5b5a78457730012f73c530b84d911f14d7fb7597632568e13a6
-
memory/320-199-0x0000000000000000-mapping.dmp
-
memory/368-208-0x0000000000000000-mapping.dmp
-
memory/472-305-0x0000000000000000-mapping.dmp
-
memory/524-202-0x0000000000000000-mapping.dmp
-
memory/548-296-0x0000000000000000-mapping.dmp
-
memory/584-290-0x0000000000000000-mapping.dmp
-
memory/680-287-0x0000000000000000-mapping.dmp
-
memory/692-211-0x0000000000000000-mapping.dmp
-
memory/760-217-0x0000000000000000-mapping.dmp
-
memory/772-311-0x0000000000000000-mapping.dmp
-
memory/800-114-0x0000000000000000-mapping.dmp
-
memory/836-242-0x0000000000000000-mapping.dmp
-
memory/856-239-0x0000000000000000-mapping.dmp
-
memory/864-181-0x0000000000000000-mapping.dmp
-
memory/912-196-0x0000000000000000-mapping.dmp
-
memory/920-284-0x0000000000000000-mapping.dmp
-
memory/952-84-0x0000000000000000-mapping.dmp
-
memory/964-299-0x0000000000000000-mapping.dmp
-
memory/972-281-0x0000000000000000-mapping.dmp
-
memory/1080-167-0x0000000000000000-mapping.dmp
-
memory/1084-236-0x0000000000000000-mapping.dmp
-
memory/1088-272-0x0000000000000000-mapping.dmp
-
memory/1124-233-0x0000000000000000-mapping.dmp
-
memory/1128-106-0x0000000000000000-mapping.dmp
-
memory/1164-248-0x0000000000000000-mapping.dmp
-
memory/1176-254-0x0000000000000000-mapping.dmp
-
memory/1180-230-0x0000000000000000-mapping.dmp
-
memory/1244-120-0x0000000000000000-mapping.dmp
-
memory/1296-214-0x0000000000000000-mapping.dmp
-
memory/1320-302-0x0000000000000000-mapping.dmp
-
memory/1352-178-0x0000000000000000-mapping.dmp
-
memory/1364-205-0x0000000000000000-mapping.dmp
-
memory/1364-94-0x0000000000000000-mapping.dmp
-
memory/1368-154-0x0000000000000000-mapping.dmp
-
memory/1376-140-0x0000000000000000-mapping.dmp
-
memory/1448-308-0x0000000000000000-mapping.dmp
-
memory/1452-64-0x0000000000000000-mapping.dmp
-
memory/1456-227-0x0000000000000000-mapping.dmp
-
memory/1468-245-0x0000000000000000-mapping.dmp
-
memory/1504-70-0x0000000000000000-mapping.dmp
-
memory/1508-223-0x0000000000000000-mapping.dmp
-
memory/1532-269-0x0000000000000000-mapping.dmp
-
memory/1540-278-0x0000000000000000-mapping.dmp
-
memory/1548-83-0x0000000000000000-mapping.dmp
-
memory/1556-251-0x0000000000000000-mapping.dmp
-
memory/1584-100-0x0000000000000000-mapping.dmp
-
memory/1596-260-0x0000000000000000-mapping.dmp
-
memory/1600-76-0x0000000000000000-mapping.dmp
-
memory/1600-193-0x0000000000000000-mapping.dmp
-
memory/1620-263-0x0000000000000000-mapping.dmp
-
memory/1620-173-0x0000000000000000-mapping.dmp
-
memory/1652-275-0x0000000000000000-mapping.dmp
-
memory/1656-220-0x0000000000000000-mapping.dmp
-
memory/1684-187-0x0000000000000000-mapping.dmp
-
memory/1720-134-0x0000000000000000-mapping.dmp
-
memory/1728-190-0x0000000000000000-mapping.dmp
-
memory/1736-147-0x0000000000000000-mapping.dmp
-
memory/1764-160-0x0000000000000000-mapping.dmp
-
memory/1792-184-0x0000000000000000-mapping.dmp
-
memory/1860-293-0x0000000000000000-mapping.dmp
-
memory/1872-226-0x0000000073FD1000-0x0000000073FD3000-memory.dmpFilesize
8KB
-
memory/1872-111-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/1884-257-0x0000000000000000-mapping.dmp
-
memory/1980-127-0x0000000000000000-mapping.dmp
-
memory/2000-266-0x0000000000000000-mapping.dmp
-
memory/2044-58-0x0000000000000000-mapping.dmp