Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe
Resource
win10v2004-20221111-en
General
-
Target
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe
-
Size
72KB
-
MD5
1733514be43ef150ccf7761da9fc39c5
-
SHA1
59296f333f41dcc4435b5362ca924b47f946ecc0
-
SHA256
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a
-
SHA512
210681ac4c4a50387100fc1ab413e8ba52b0a8aa3f1544f572b647981a76246d1b6dd7896ab94acb38afae56e4449520b1cc806469d1853173e4af6429ed2fe4
-
SSDEEP
768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRrCy+:teThavEjDWguKCb
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
backup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exepid process 1736 backup.exe 1508 backup.exe 1296 backup.exe 1344 backup.exe 1228 backup.exe 772 backup.exe 1944 backup.exe 316 backup.exe 804 backup.exe 1972 backup.exe 1840 backup.exe 1992 backup.exe 1556 backup.exe 968 backup.exe 324 backup.exe 1016 backup.exe 360 backup.exe 1996 update.exe 1420 backup.exe 2004 backup.exe 1764 backup.exe 1812 backup.exe 2008 backup.exe 1784 backup.exe 1980 backup.exe 368 backup.exe 916 backup.exe 432 backup.exe 1608 backup.exe 1008 backup.exe 1380 backup.exe 320 update.exe 1972 backup.exe 456 backup.exe 900 backup.exe 1260 backup.exe 992 backup.exe 1984 backup.exe 1976 backup.exe 1272 backup.exe 1520 backup.exe 1568 backup.exe 620 backup.exe 820 backup.exe 948 backup.exe 1780 backup.exe 1996 backup.exe 1624 backup.exe 2004 backup.exe 1424 data.exe 1316 backup.exe 648 data.exe 896 backup.exe 1228 backup.exe 688 backup.exe 904 backup.exe 932 backup.exe 1880 backup.exe 764 backup.exe 1712 backup.exe 320 backup.exe 1972 backup.exe 456 backup.exe 1384 backup.exe -
Loads dropped DLL 64 IoCs
Processes:
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exeupdate.exepid process 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 316 backup.exe 316 backup.exe 804 backup.exe 804 backup.exe 316 backup.exe 316 backup.exe 1840 backup.exe 1840 backup.exe 1992 backup.exe 1992 backup.exe 1840 backup.exe 1840 backup.exe 968 backup.exe 968 backup.exe 324 backup.exe 324 backup.exe 324 backup.exe 324 backup.exe 360 backup.exe 1996 update.exe 1996 update.exe 1996 update.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 360 backup.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 320 update.exe -
Drops file in Program Files directory 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\System Restore.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe backup.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\Chess\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe data.exe File opened for modification C:\Program Files\Reference Assemblies\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Java\jre7\lib\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe data.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
Processes:
backup.exedescription ioc process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exepid process 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exepid process 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe 1736 backup.exe 1508 backup.exe 1296 backup.exe 1344 backup.exe 1228 backup.exe 772 backup.exe 1944 backup.exe 316 backup.exe 804 backup.exe 1972 backup.exe 1840 backup.exe 1992 backup.exe 1556 backup.exe 968 backup.exe 324 backup.exe 1016 backup.exe 360 backup.exe 1996 update.exe 1420 backup.exe 2004 backup.exe 1764 backup.exe 1812 backup.exe 2008 backup.exe 1784 backup.exe 1980 backup.exe 368 backup.exe 916 backup.exe 432 backup.exe 1608 backup.exe 1008 backup.exe 1380 backup.exe 320 update.exe 1972 backup.exe 456 backup.exe 900 backup.exe 1260 backup.exe 992 backup.exe 1984 backup.exe 1976 backup.exe 1272 backup.exe 1520 backup.exe 1568 backup.exe 620 backup.exe 820 backup.exe 948 backup.exe 1780 backup.exe 1996 backup.exe 1624 backup.exe 2004 backup.exe 1424 data.exe 1316 backup.exe 648 data.exe 896 backup.exe 1228 backup.exe 688 backup.exe 904 backup.exe 932 backup.exe 1880 backup.exe 764 backup.exe 1712 backup.exe 320 backup.exe 1972 backup.exe 456 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedescription pid process target process PID 1884 wrote to memory of 1736 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1736 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1736 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1736 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1508 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1508 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1508 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1508 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1296 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1296 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1296 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1296 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1344 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1344 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1344 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1344 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1228 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1228 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1228 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1228 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 772 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 772 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 772 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 772 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1944 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1944 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1944 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1884 wrote to memory of 1944 1884 5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe backup.exe PID 1736 wrote to memory of 316 1736 backup.exe backup.exe PID 1736 wrote to memory of 316 1736 backup.exe backup.exe PID 1736 wrote to memory of 316 1736 backup.exe backup.exe PID 1736 wrote to memory of 316 1736 backup.exe backup.exe PID 316 wrote to memory of 804 316 backup.exe backup.exe PID 316 wrote to memory of 804 316 backup.exe backup.exe PID 316 wrote to memory of 804 316 backup.exe backup.exe PID 316 wrote to memory of 804 316 backup.exe backup.exe PID 804 wrote to memory of 1972 804 backup.exe backup.exe PID 804 wrote to memory of 1972 804 backup.exe backup.exe PID 804 wrote to memory of 1972 804 backup.exe backup.exe PID 804 wrote to memory of 1972 804 backup.exe backup.exe PID 316 wrote to memory of 1840 316 backup.exe backup.exe PID 316 wrote to memory of 1840 316 backup.exe backup.exe PID 316 wrote to memory of 1840 316 backup.exe backup.exe PID 316 wrote to memory of 1840 316 backup.exe backup.exe PID 1840 wrote to memory of 1992 1840 backup.exe backup.exe PID 1840 wrote to memory of 1992 1840 backup.exe backup.exe PID 1840 wrote to memory of 1992 1840 backup.exe backup.exe PID 1840 wrote to memory of 1992 1840 backup.exe backup.exe PID 1992 wrote to memory of 1556 1992 backup.exe backup.exe PID 1992 wrote to memory of 1556 1992 backup.exe backup.exe PID 1992 wrote to memory of 1556 1992 backup.exe backup.exe PID 1992 wrote to memory of 1556 1992 backup.exe backup.exe PID 1840 wrote to memory of 968 1840 backup.exe backup.exe PID 1840 wrote to memory of 968 1840 backup.exe backup.exe PID 1840 wrote to memory of 968 1840 backup.exe backup.exe PID 1840 wrote to memory of 968 1840 backup.exe backup.exe PID 968 wrote to memory of 324 968 backup.exe backup.exe PID 968 wrote to memory of 324 968 backup.exe backup.exe PID 968 wrote to memory of 324 968 backup.exe backup.exe PID 968 wrote to memory of 324 968 backup.exe backup.exe PID 324 wrote to memory of 1016 324 backup.exe backup.exe PID 324 wrote to memory of 1016 324 backup.exe backup.exe PID 324 wrote to memory of 1016 324 backup.exe backup.exe PID 324 wrote to memory of 1016 324 backup.exe backup.exe -
System policy modification 1 TTPs 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exedata.exebackup.exebackup.exeupdate.exedata.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe"C:\Users\Admin\AppData\Local\Temp\5cd89922592e7dbb5adcced2ddb14684c4ff603dd7fd321916085f66a117ad1a.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\558877585\backup.exeC:\Users\Admin\AppData\Local\Temp\558877585\backup.exe C:\Users\Admin\AppData\Local\Temp\558877585\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\data.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵
-
C:\Program Files\Common Files\Services\data.exe"C:\Program Files\Common Files\Services\data.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\update.exe"C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- System policy modification
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\msadc\es-ES\System Restore.exe"C:\Program Files\Common Files\System\msadc\es-ES\System Restore.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\8⤵
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\8⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\8⤵
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\Chrome\Application\update.exe"C:\Program Files\Google\Chrome\Application\update.exe" C:\Program Files\Google\Chrome\Application\7⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵
- System policy modification
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- System policy modification
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Java\data.exe"C:\Program Files\Java\data.exe" C:\Program Files\Java\5⤵
- System policy modification
-
C:\Program Files\Java\jdk1.7.0_80\System Restore.exe"C:\Program Files\Java\jdk1.7.0_80\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵
- System policy modification
-
C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\8⤵
-
C:\Program Files\Java\jdk1.7.0_80\include\backup.exe"C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\9⤵
- System policy modification
-
C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\7⤵
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\9⤵
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\9⤵
-
C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\9⤵
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\8⤵
-
C:\Program Files\Java\jdk1.7.0_80\lib\System Restore.exe"C:\Program Files\Java\jdk1.7.0_80\lib\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\7⤵
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵
- Drops file in Program Files directory
-
C:\Program Files\Java\jre7\bin\backup.exe"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Java\jre7\bin\dtplugin\backup.exe"C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Java\jre7\bin\plugin2\backup.exe"C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\8⤵
-
C:\Program Files\Java\jre7\bin\server\backup.exe"C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\8⤵
-
C:\Program Files\Java\jre7\lib\backup.exe"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\7⤵
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Drops file in Program Files directory
-
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵
-
C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\7⤵
-
C:\Program Files\Microsoft Games\Chess\en-US\backup.exe"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\7⤵
-
C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\7⤵
-
C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe"C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\7⤵
-
C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe"C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\7⤵
-
C:\Program Files\Microsoft Games\FreeCell\System Restore.exe"C:\Program Files\Microsoft Games\FreeCell\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\6⤵
-
C:\Program Files\Microsoft Games\Mahjong\backup.exe"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\6⤵
-
C:\Program Files\Microsoft Games\Minesweeper\backup.exe"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\6⤵
-
C:\Program Files\Microsoft Games\More Games\backup.exe"C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\6⤵
-
C:\Program Files\Microsoft Games\Multiplayer\backup.exe"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\6⤵
-
C:\Program Files\Microsoft Games\Purble Place\backup.exe"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\6⤵
-
C:\Program Files\Microsoft Games\Solitaire\backup.exe"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\6⤵
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵
-
C:\Program Files\VideoLAN\System Restore.exe"C:\Program Files\VideoLAN\System Restore.exe" C:\Program Files\VideoLAN\5⤵
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\5⤵
-
C:\Program Files\Windows Journal\backup.exe"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\5⤵
-
C:\Program Files\Windows Mail\backup.exe"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\5⤵
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\Adobe\data.exe"C:\Program Files (x86)\Common Files\Adobe\data.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
C:\Program Files (x86)\Internet Explorer\System Restore.exe"C:\Program Files (x86)\Internet Explorer\System Restore.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
-
C:\Users\Public\data.exeC:\Users\Public\data.exe C:\Users\Public\5⤵
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\Admin\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
C:\PerfLogs\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
C:\PerfLogs\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
C:\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD55f9079a57691ad5f9ecfeb27410ae208
SHA1088bf5f5e794298d434577d4793c34ff2d4ce0e0
SHA2566905b69ae06f15f39d407b99d9983619f572d044fe920844cff31dfa5c4277ac
SHA512ab6926fe7ed4955d6fc90fb06dfba8e2654e4e8d1bbfe236367a2118dade81445b66515e03373de4532f91e4bde90418e89ba35174abca6f81aad34bf7ed07ec
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD53ed86be7be2948a1fc6a06da58cada34
SHA14383ac2136a826d87187b38073a62508636b048c
SHA2560b6cfc6db4cf77716f430cefa735da9e9170ec631af42a7746c15fbb94d77b07
SHA512af82d6b1b70fb31e1e7b18ea400e6e9c2e7382e979ce2f457ef1beedcb735a486a95df06b8871f9091b3682f05f0652adc07e3fb99c8a526a7033469b06d8ad0
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD53ed86be7be2948a1fc6a06da58cada34
SHA14383ac2136a826d87187b38073a62508636b048c
SHA2560b6cfc6db4cf77716f430cefa735da9e9170ec631af42a7746c15fbb94d77b07
SHA512af82d6b1b70fb31e1e7b18ea400e6e9c2e7382e979ce2f457ef1beedcb735a486a95df06b8871f9091b3682f05f0652adc07e3fb99c8a526a7033469b06d8ad0
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
C:\Program Files\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
C:\Program Files\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
C:\Users\Admin\AppData\Local\Temp\558877585\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
C:\Users\Admin\AppData\Local\Temp\558877585\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
C:\backup.exeFilesize
72KB
MD54341fab15f5d5a0cbf52577b4c4519e6
SHA1ad3583bb767a92bb7c966899725ebf956debe35d
SHA256e235dd360593718a1bd1024cf2ee400afed74011b019eef83135bdf74a99cfee
SHA512f439b38b3776c2183fed075a36af33b86f0193eeb0b8927b305a4e2d0a6bc69d2f9bf4e66d7c4851ba0ab9f236f623e7874f63ebf502071ab5786fd0fc8b9c22
-
C:\backup.exeFilesize
72KB
MD54341fab15f5d5a0cbf52577b4c4519e6
SHA1ad3583bb767a92bb7c966899725ebf956debe35d
SHA256e235dd360593718a1bd1024cf2ee400afed74011b019eef83135bdf74a99cfee
SHA512f439b38b3776c2183fed075a36af33b86f0193eeb0b8927b305a4e2d0a6bc69d2f9bf4e66d7c4851ba0ab9f236f623e7874f63ebf502071ab5786fd0fc8b9c22
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
\PerfLogs\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
\PerfLogs\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD55f9079a57691ad5f9ecfeb27410ae208
SHA1088bf5f5e794298d434577d4793c34ff2d4ce0e0
SHA2566905b69ae06f15f39d407b99d9983619f572d044fe920844cff31dfa5c4277ac
SHA512ab6926fe7ed4955d6fc90fb06dfba8e2654e4e8d1bbfe236367a2118dade81445b66515e03373de4532f91e4bde90418e89ba35174abca6f81aad34bf7ed07ec
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD55f9079a57691ad5f9ecfeb27410ae208
SHA1088bf5f5e794298d434577d4793c34ff2d4ce0e0
SHA2566905b69ae06f15f39d407b99d9983619f572d044fe920844cff31dfa5c4277ac
SHA512ab6926fe7ed4955d6fc90fb06dfba8e2654e4e8d1bbfe236367a2118dade81445b66515e03373de4532f91e4bde90418e89ba35174abca6f81aad34bf7ed07ec
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD51d597ceb2b4c1154578a34d6be7c12fb
SHA1f0aba780dfd0633cd7ed0cf780179108c33bcd54
SHA256bfa8ed839b014d5fe796adcb724c887d8c30abbe3c823915893cfced4412b663
SHA512176c6c3fe1b5dbbefea046522964ace5fc91907677c9b2454dba6cdc073556e81261ad11033bf0800ffa408af99c5b8e3ac55151c1cde91efbbad6eb129e28de
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD53ed86be7be2948a1fc6a06da58cada34
SHA14383ac2136a826d87187b38073a62508636b048c
SHA2560b6cfc6db4cf77716f430cefa735da9e9170ec631af42a7746c15fbb94d77b07
SHA512af82d6b1b70fb31e1e7b18ea400e6e9c2e7382e979ce2f457ef1beedcb735a486a95df06b8871f9091b3682f05f0652adc07e3fb99c8a526a7033469b06d8ad0
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD53ed86be7be2948a1fc6a06da58cada34
SHA14383ac2136a826d87187b38073a62508636b048c
SHA2560b6cfc6db4cf77716f430cefa735da9e9170ec631af42a7746c15fbb94d77b07
SHA512af82d6b1b70fb31e1e7b18ea400e6e9c2e7382e979ce2f457ef1beedcb735a486a95df06b8871f9091b3682f05f0652adc07e3fb99c8a526a7033469b06d8ad0
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD564ee5529f9826ecb2b00f5cb34f50bac
SHA16f6ef80f6cb0e68ebd6fc8adbf6a8fa91c200ac6
SHA256f92017278dcb21dd4726a41a593b62a0580afd084334022c3e32b6669a3565e9
SHA512a465822b73ebc4a60a1552b461acc9d4fa5f3c3615f883b75ca15e787ebdcb0957b4a26b12f01ffc3af3a7084f4bd5be64778f5fb0dc09cbf6741d5a842a39db
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5337a955eaa5f04dcc28488a447a99ef0
SHA14d172cb9293ef0eb24d81a9a563c67f76bedb603
SHA256416373b1f12d163fd194b62b4460774babb966d77ffcd260e5e7fc3f6ef51d5f
SHA512808e3587f1b26a446919d3633877f434a1ae8e5c0f9cd60ab1d61fb9640503bc54b6514e59003d96bac0ab69ff29229e34645a0b5877cbc916bbabb1b0d77203
-
\Program Files\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
\Program Files\backup.exeFilesize
72KB
MD5088ba36815c75943f101e7e40c777b5d
SHA1fb49302be4c2512c2d061613097aad5875cd1e8a
SHA256609a3d55e7612e6f306e942b727d4077311509774481196e4e95d6f958f49f22
SHA5122338ba477d9375f9d96dfd380584acf7e3b592ff866111a63b0006d76cc7ac5bc0db56bdcc0627df2193e5bceb9aa6e9ff411908fe8a0d0aba861ace4599c497
-
\Users\Admin\AppData\Local\Temp\558877585\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
\Users\Admin\AppData\Local\Temp\558877585\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5ac41ad21f6487cc6907af73fa7de995c
SHA1f831f69e9543d0c795cb5137dbaac7d6699d6201
SHA2565ae975bb7fa073c0e4a3d9b1f4edf11cd6c2d8168139a048689b05367c3b7fe0
SHA512f5d852d93e8fec2d8654199206079ec68d421919aed305a75aeb140a7bba7043619e7ab23552c6da40e67aedd36a93c1ef7a6b7b3945254d805b46e0490f8f95
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD51c484294671bdcbb82c579a3c89b4bf5
SHA19cb9c00f19b577b5bd1f48bb7b12f48f1108845f
SHA25647a8af7d255beecd343756ad530dcd7a27184522d465ca163570b82f3f32a631
SHA512a05bb0b8eb9878cfc412f412cdd1b3e391a210a4c5e13ad4ecba7f350822f9633ee3cc739bbce380fbb75933c083fad3dee822343eb738e41a450135dfc513ab
-
memory/316-100-0x0000000000000000-mapping.dmp
-
memory/320-216-0x0000000000000000-mapping.dmp
-
memory/320-304-0x0000000000000000-mapping.dmp
-
memory/324-148-0x0000000000000000-mapping.dmp
-
memory/360-161-0x0000000000000000-mapping.dmp
-
memory/368-198-0x0000000000000000-mapping.dmp
-
memory/432-204-0x0000000000000000-mapping.dmp
-
memory/456-310-0x0000000000000000-mapping.dmp
-
memory/456-223-0x0000000000000000-mapping.dmp
-
memory/620-250-0x0000000000000000-mapping.dmp
-
memory/648-277-0x0000000000000000-mapping.dmp
-
memory/688-286-0x0000000000000000-mapping.dmp
-
memory/764-298-0x0000000000000000-mapping.dmp
-
memory/772-88-0x0000000000000000-mapping.dmp
-
memory/804-107-0x0000000000000000-mapping.dmp
-
memory/820-253-0x0000000000000000-mapping.dmp
-
memory/896-280-0x0000000000000000-mapping.dmp
-
memory/900-226-0x0000000000000000-mapping.dmp
-
memory/904-289-0x0000000000000000-mapping.dmp
-
memory/916-201-0x0000000000000000-mapping.dmp
-
memory/932-292-0x0000000000000000-mapping.dmp
-
memory/948-256-0x0000000000000000-mapping.dmp
-
memory/968-141-0x0000000000000000-mapping.dmp
-
memory/992-232-0x0000000000000000-mapping.dmp
-
memory/1008-210-0x0000000000000000-mapping.dmp
-
memory/1016-155-0x0000000000000000-mapping.dmp
-
memory/1228-82-0x0000000000000000-mapping.dmp
-
memory/1228-283-0x0000000000000000-mapping.dmp
-
memory/1260-229-0x0000000000000000-mapping.dmp
-
memory/1272-241-0x0000000000000000-mapping.dmp
-
memory/1296-70-0x0000000000000000-mapping.dmp
-
memory/1316-274-0x0000000000000000-mapping.dmp
-
memory/1344-76-0x0000000000000000-mapping.dmp
-
memory/1380-213-0x0000000000000000-mapping.dmp
-
memory/1384-313-0x0000000000000000-mapping.dmp
-
memory/1420-177-0x0000000000000000-mapping.dmp
-
memory/1424-271-0x0000000000000000-mapping.dmp
-
memory/1508-64-0x0000000000000000-mapping.dmp
-
memory/1520-244-0x0000000000000000-mapping.dmp
-
memory/1556-135-0x0000000000000000-mapping.dmp
-
memory/1568-247-0x0000000000000000-mapping.dmp
-
memory/1608-207-0x0000000000000000-mapping.dmp
-
memory/1624-265-0x0000000000000000-mapping.dmp
-
memory/1712-301-0x0000000000000000-mapping.dmp
-
memory/1736-58-0x0000000000000000-mapping.dmp
-
memory/1764-183-0x0000000000000000-mapping.dmp
-
memory/1780-259-0x0000000000000000-mapping.dmp
-
memory/1784-192-0x0000000000000000-mapping.dmp
-
memory/1812-186-0x0000000000000000-mapping.dmp
-
memory/1840-120-0x0000000000000000-mapping.dmp
-
memory/1880-295-0x0000000000000000-mapping.dmp
-
memory/1884-130-0x0000000074C01000-0x0000000074C03000-memory.dmpFilesize
8KB
-
memory/1884-98-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1944-94-0x0000000000000000-mapping.dmp
-
memory/1972-114-0x0000000000000000-mapping.dmp
-
memory/1972-307-0x0000000000000000-mapping.dmp
-
memory/1972-220-0x0000000000000000-mapping.dmp
-
memory/1976-238-0x0000000000000000-mapping.dmp
-
memory/1980-195-0x0000000000000000-mapping.dmp
-
memory/1984-235-0x0000000000000000-mapping.dmp
-
memory/1992-127-0x0000000000000000-mapping.dmp
-
memory/1996-262-0x0000000000000000-mapping.dmp
-
memory/1996-167-0x0000000000000000-mapping.dmp
-
memory/2004-180-0x0000000000000000-mapping.dmp
-
memory/2004-268-0x0000000000000000-mapping.dmp
-
memory/2008-189-0x0000000000000000-mapping.dmp