Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe
Resource
win10v2004-20220812-en
General
-
Target
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe
-
Size
72KB
-
MD5
99b305c136093759ead2a2fc21bd59ee
-
SHA1
04a97fea8f714e0fdb92744be820ec7c43c7c85e
-
SHA256
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f
-
SHA512
001d5e80a9f6c0839937c9b31bac59233d9994607cb3b37ecba1e0744c1caee069aa92688507109943ca70af17fcaf56d8827683a6d62a224e5ba6282b3ee973
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2c:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrQ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
backup.exebackup.exebackup.exe4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exedata.exebackup.exebackup.exeupdate.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exeSystem Restore.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exeupdate.exebackup.exeSystem Restore.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exepid process 1352 backup.exe 740 backup.exe 940 backup.exe 1636 backup.exe 1748 backup.exe 1312 backup.exe 1176 backup.exe 1328 backup.exe 1484 backup.exe 584 backup.exe 816 backup.exe 364 backup.exe 1812 data.exe 676 backup.exe 1532 backup.exe 1824 backup.exe 1716 backup.exe 540 backup.exe 1604 backup.exe 1444 backup.exe 1760 backup.exe 1772 backup.exe 1572 backup.exe 1676 backup.exe 1860 backup.exe 612 backup.exe 1864 backup.exe 1868 backup.exe 2036 backup.exe 1200 backup.exe 1220 update.exe 1484 backup.exe 1536 update.exe 1624 backup.exe 1736 System Restore.exe 896 backup.exe 240 System Restore.exe 1388 backup.exe 1800 backup.exe 1576 backup.exe 1052 backup.exe 1876 backup.exe 1824 backup.exe 1644 backup.exe 1744 backup.exe 1244 backup.exe 1496 update.exe 1780 backup.exe 852 backup.exe 1760 backup.exe 1772 backup.exe 1572 backup.exe 1676 backup.exe 1860 backup.exe 612 backup.exe 1864 backup.exe 1868 update.exe 1328 backup.exe 1872 data.exe 1176 backup.exe 428 backup.exe 1536 backup.exe 1624 backup.exe 1736 backup.exe -
Loads dropped DLL 64 IoCs
Processes:
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exepid process 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 1748 backup.exe 1748 backup.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 1176 backup.exe 1176 backup.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 1748 backup.exe 1748 backup.exe 816 backup.exe 816 backup.exe 364 backup.exe 364 backup.exe 816 backup.exe 816 backup.exe 676 backup.exe 676 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 1716 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 1220 update.exe 1220 update.exe 1220 update.exe 2036 backup.exe 2036 backup.exe -
Drops file in Program Files directory 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedescription ioc process File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\update.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe update.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\data.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
Processes:
backup.exedescription ioc process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exepid process 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exeupdate.exebackup.exeSystem Restore.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exedata.exebackup.exebackup.exebackup.exebackup.exebackup.exepid process 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe 1352 backup.exe 740 backup.exe 940 backup.exe 1636 backup.exe 1748 backup.exe 1312 backup.exe 1176 backup.exe 1328 backup.exe 1484 backup.exe 584 backup.exe 816 backup.exe 364 backup.exe 1812 data.exe 676 backup.exe 1532 backup.exe 1824 backup.exe 1716 backup.exe 1604 backup.exe 1444 backup.exe 1760 backup.exe 1772 backup.exe 1572 backup.exe 1676 backup.exe 1860 backup.exe 612 backup.exe 1864 backup.exe 1868 backup.exe 2036 backup.exe 1200 backup.exe 1220 update.exe 1484 backup.exe 1536 update.exe 1624 backup.exe 1736 System Restore.exe 896 backup.exe 240 System Restore.exe 1388 backup.exe 1800 backup.exe 1576 backup.exe 1052 backup.exe 1876 backup.exe 1824 backup.exe 1644 backup.exe 1744 backup.exe 1244 backup.exe 1496 update.exe 1780 backup.exe 852 backup.exe 1760 backup.exe 1772 backup.exe 1572 backup.exe 1676 backup.exe 1860 backup.exe 612 backup.exe 1864 backup.exe 1868 update.exe 1328 backup.exe 1872 data.exe 1176 backup.exe 428 backup.exe 1536 backup.exe 1624 backup.exe 1736 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedescription pid process target process PID 2020 wrote to memory of 1352 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1352 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1352 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1352 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 740 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 740 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 740 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 740 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 940 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 940 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 940 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 940 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1636 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1636 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1636 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1636 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 1352 wrote to memory of 1748 1352 backup.exe backup.exe PID 1352 wrote to memory of 1748 1352 backup.exe backup.exe PID 1352 wrote to memory of 1748 1352 backup.exe backup.exe PID 1352 wrote to memory of 1748 1352 backup.exe backup.exe PID 2020 wrote to memory of 1312 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1312 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1312 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1312 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 1748 wrote to memory of 1176 1748 backup.exe backup.exe PID 1748 wrote to memory of 1176 1748 backup.exe backup.exe PID 1748 wrote to memory of 1176 1748 backup.exe backup.exe PID 1748 wrote to memory of 1176 1748 backup.exe backup.exe PID 2020 wrote to memory of 1328 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1328 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1328 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 1328 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 1176 wrote to memory of 1484 1176 backup.exe backup.exe PID 1176 wrote to memory of 1484 1176 backup.exe backup.exe PID 1176 wrote to memory of 1484 1176 backup.exe backup.exe PID 1176 wrote to memory of 1484 1176 backup.exe backup.exe PID 2020 wrote to memory of 584 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 584 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 584 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 2020 wrote to memory of 584 2020 4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe backup.exe PID 1748 wrote to memory of 816 1748 backup.exe backup.exe PID 1748 wrote to memory of 816 1748 backup.exe backup.exe PID 1748 wrote to memory of 816 1748 backup.exe backup.exe PID 1748 wrote to memory of 816 1748 backup.exe backup.exe PID 816 wrote to memory of 364 816 backup.exe backup.exe PID 816 wrote to memory of 364 816 backup.exe backup.exe PID 816 wrote to memory of 364 816 backup.exe backup.exe PID 816 wrote to memory of 364 816 backup.exe backup.exe PID 364 wrote to memory of 1812 364 backup.exe data.exe PID 364 wrote to memory of 1812 364 backup.exe data.exe PID 364 wrote to memory of 1812 364 backup.exe data.exe PID 364 wrote to memory of 1812 364 backup.exe data.exe PID 816 wrote to memory of 676 816 backup.exe backup.exe PID 816 wrote to memory of 676 816 backup.exe backup.exe PID 816 wrote to memory of 676 816 backup.exe backup.exe PID 816 wrote to memory of 676 816 backup.exe backup.exe PID 676 wrote to memory of 1532 676 backup.exe backup.exe PID 676 wrote to memory of 1532 676 backup.exe backup.exe PID 676 wrote to memory of 1532 676 backup.exe backup.exe PID 676 wrote to memory of 1532 676 backup.exe backup.exe PID 1532 wrote to memory of 1824 1532 backup.exe backup.exe PID 1532 wrote to memory of 1824 1532 backup.exe backup.exe PID 1532 wrote to memory of 1824 1532 backup.exe backup.exe PID 1532 wrote to memory of 1824 1532 backup.exe backup.exe -
System policy modification 1 TTPs 64 IoCs
Processes:
backup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeupdate.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exeSystem Restore.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exebackup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe"C:\Users\Admin\AppData\Local\Temp\4c8b7439d844ab71514698ff0d35bb74755affdb1c2911df14e7620a14ae253f.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\734086432\backup.exeC:\Users\Admin\AppData\Local\Temp\734086432\backup.exe C:\Users\Admin\AppData\Local\Temp\734086432\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:364 -
C:\Program Files\7-Zip\Lang\data.exe"C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1812 -
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1716 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:540 -
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444 -
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760 -
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1772 -
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1676 -
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1860 -
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:612 -
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1864 -
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1220 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:896 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1388 -
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052 -
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644 -
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744 -
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1244 -
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496 -
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1780 -
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760 -
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1772 -
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1860 -
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:612 -
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1328 -
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872 -
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176 -
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:428 -
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1536 -
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:896 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:804 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:980 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1812 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1184 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1620
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Drops file in Program Files directory
PID:1460 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1052
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
PID:876 -
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2040 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1592 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:540 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Disables RegEdit via registry modification
PID:1596 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1652 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1604 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- System policy modification
PID:1496 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- System policy modification
PID:1444 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
PID:1900 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1672 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1488 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:2028
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1692 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Disables RegEdit via registry modification
PID:1696 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1944 -
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1244 -
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Disables RegEdit via registry modification
PID:1592 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:612 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1488 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\data.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1740 -
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:972 -
C:\Program Files\Common Files\SpeechEngines\System Restore.exe"C:\Program Files\Common Files\SpeechEngines\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- System policy modification
PID:560 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:884 -
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:984 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
PID:2036 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1808 -
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:1192 -
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
PID:1744 -
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:1776 -
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
PID:1888 -
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1948 -
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:2024
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
PID:1740 -
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1764
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:988
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1804
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1404
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1200
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1124
-
C:\Program Files\DVD Maker\System Restore.exe"C:\Program Files\DVD Maker\System Restore.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1832 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:960 -
C:\Program Files\DVD Maker\en-US\data.exe"C:\Program Files\DVD Maker\en-US\data.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:808
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:428
-
C:\Program Files\DVD Maker\fr-FR\data.exe"C:\Program Files\DVD Maker\fr-FR\data.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
PID:1408 -
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- System policy modification
PID:1052 -
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- System policy modification
PID:2032 -
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1444
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1672 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1616
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1872 -
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Modifies visibility of file extensions in Explorer
PID:1036 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:364
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1812
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- System policy modification
PID:1736 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- System policy modification
PID:1100 -
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1460
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1900
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
- Disables RegEdit via registry modification
PID:2032 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵
- Modifies visibility of file extensions in Explorer
PID:1896 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:1864
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:592
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵
- Modifies visibility of file extensions in Explorer
PID:1176 -
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵
- Disables RegEdit via registry modification
PID:560 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1856 -
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\8⤵PID:1692
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1820 -
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\8⤵PID:956
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\8⤵PID:1900
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1140
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:364
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:744
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1744
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1860
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1220
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:1636
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:1468
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- System policy modification
PID:1808 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:1160
-
C:\Program Files\Java\jre7\System Restore.exe"C:\Program Files\Java\jre7\System Restore.exe" C:\Program Files\Java\jre7\6⤵PID:1948
-
C:\Program Files\Microsoft Games\update.exe"C:\Program Files\Microsoft Games\update.exe" C:\Program Files\Microsoft Games\5⤵PID:1564
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2040
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1136
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2036
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:896
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:1916
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:628 -
C:\Program Files (x86)\Adobe\update.exe"C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:948 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:928 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:756 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
PID:856 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:1880
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Disables RegEdit via registry modification
PID:1624 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:804
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Drops file in Program Files directory
PID:1804 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:1460
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1680 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:592
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:268 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:884
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1880 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:328 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵PID:1692
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:1824
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Drops file in Program Files directory
- System policy modification
PID:2040 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1604 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1944 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵PID:1744
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1572
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:972 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1152
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- Disables RegEdit via registry modification
PID:516 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1132
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1532 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:552
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1716
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1828
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1800
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1184
-
C:\Program Files (x86)\Microsoft Office\update.exe"C:\Program Files (x86)\Microsoft Office\update.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1680
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1592
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1152
-
C:\Program Files (x86)\Microsoft Synchronization Services\data.exe"C:\Program Files (x86)\Microsoft Synchronization Services\data.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:1772
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:1444
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:808 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1884
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1596
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- System policy modification
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:740 -
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\Admin\backup.exeFilesize
72KB
MD5a94ad29759eec227b6f4f982d1083d6d
SHA11b50109ba433cb17d38b74dd24ad74f00b1110b6
SHA25664c9c06ad7f904ed9de0f493e329b764f082993cb65e37691f10ba626df1e686
SHA512e4351954cb23c049be9a76d5e243bcdfd20cc79d3ecacd85cbc49cdcf009255c687d32d13f243e26bfdf93a80f85a1730c30bde6ce5dc5712b9ae5748ac5c0d3
-
C:\PerfLogs\backup.exeFilesize
72KB
MD56fef79ff83cf16120f70c7fc3a5e8a85
SHA1d96b75c22f8cd68f5d99e0ea0f704e631a96664c
SHA2568979c6915e7a2d1016576022ad3a4fc9bb01e683d7b01a7e051bcfc2eb817cdd
SHA512f321e8634d4321e1e876e04cc2bddf9afa77d08e0e5273ae070570b7340b68d1d54be2c38547f61efcbb4eb66b9902222121ed4144b3964582229a83bfc90fb1
-
C:\PerfLogs\backup.exeFilesize
72KB
MD56fef79ff83cf16120f70c7fc3a5e8a85
SHA1d96b75c22f8cd68f5d99e0ea0f704e631a96664c
SHA2568979c6915e7a2d1016576022ad3a4fc9bb01e683d7b01a7e051bcfc2eb817cdd
SHA512f321e8634d4321e1e876e04cc2bddf9afa77d08e0e5273ae070570b7340b68d1d54be2c38547f61efcbb4eb66b9902222121ed4144b3964582229a83bfc90fb1
-
C:\Program Files\7-Zip\Lang\data.exeFilesize
72KB
MD53f6b1d8582e1acdb47303dc4736ca1eb
SHA138d2e39949416b79c177d5fcac94acb0b1e8d4f7
SHA256ff824113fc0b933990e3ae9859dc759869e6c6cb11d1879f47bf5b50fa8c144b
SHA5127c95696e5d884b9528b2bb16c1fc7b88fa1d4a55313529c4488f71ff413663669c2a11e3789ef99260ad5614dc0dd84a07d64fb21716efc202b0dbb85c33e043
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e369319685b2f1dd1c4cb9be5595a07d
SHA1aa22832545fba713bf5afe1c9c0c3c2d5bbeeca4
SHA2561877ff32bacdb2b82eefafa385d2ece34c76d821507c3bd9b2512c58b52d63c6
SHA51297c07c3c6b86f5dc99dc96d89969d67e0d7daec990efdc5c2b1ee46d1e1c55c312ba4ad1c4531bb6bda5c9b7208dffa9fbaddc4835c1dc2017be293d27beda34
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e369319685b2f1dd1c4cb9be5595a07d
SHA1aa22832545fba713bf5afe1c9c0c3c2d5bbeeca4
SHA2561877ff32bacdb2b82eefafa385d2ece34c76d821507c3bd9b2512c58b52d63c6
SHA51297c07c3c6b86f5dc99dc96d89969d67e0d7daec990efdc5c2b1ee46d1e1c55c312ba4ad1c4531bb6bda5c9b7208dffa9fbaddc4835c1dc2017be293d27beda34
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
C:\Program Files\backup.exeFilesize
72KB
MD54c685b177cd545331d95a0db89764508
SHA1620aec2ade0d2b0d6ad9cfddad05a69199caa76c
SHA25655e53732919f9eaef738d0e0703b37d7cf74f262c9e29ed915b8ef3432abd2b4
SHA512b3b401388f70b41f027fb26810cc7f31f438367715ea996f7c23769fd65f8f3ca0c83911e74338641168899f694e1a05dcfec3a5dd0dba3b250d9961de481584
-
C:\Program Files\backup.exeFilesize
72KB
MD54c685b177cd545331d95a0db89764508
SHA1620aec2ade0d2b0d6ad9cfddad05a69199caa76c
SHA25655e53732919f9eaef738d0e0703b37d7cf74f262c9e29ed915b8ef3432abd2b4
SHA512b3b401388f70b41f027fb26810cc7f31f438367715ea996f7c23769fd65f8f3ca0c83911e74338641168899f694e1a05dcfec3a5dd0dba3b250d9961de481584
-
C:\Users\Admin\AppData\Local\Temp\734086432\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
C:\Users\Admin\AppData\Local\Temp\734086432\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD5b7eb0fb6892da6acb5cdb116238a5e5b
SHA181bbda5c0b9b897ed98cb04a41daa403a613ea10
SHA256676f54d7475b2e436f70079eaace5fca36c6f2ea80f98e8e959d222dadc012ee
SHA512df56e37d1961132c30c05b3bfa0153ffbd1e8b0428fbd936144502f43b5cac508c0983be17b06adfac2d481921a5dd79237f3f04bbcbf965225ee44621c5ab2a
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
C:\backup.exeFilesize
72KB
MD5da289e6c03f5a999d33e62ad463e9a54
SHA1580e8341421f6ddebb7a6050130d2bb1cf8bd934
SHA256f0b9c545399937e4ec923521c0079a07e050920f2f747e9b0b4fc343748ab469
SHA5129c48293e8e88cab6ef569f6f7fceec2c054839a95c37aff4752dc9ae2454ad2b390cb92847de557f91589d15a2dbe1982fb13c07c0a1bd4890661476911680f9
-
C:\backup.exeFilesize
72KB
MD5da289e6c03f5a999d33e62ad463e9a54
SHA1580e8341421f6ddebb7a6050130d2bb1cf8bd934
SHA256f0b9c545399937e4ec923521c0079a07e050920f2f747e9b0b4fc343748ab469
SHA5129c48293e8e88cab6ef569f6f7fceec2c054839a95c37aff4752dc9ae2454ad2b390cb92847de557f91589d15a2dbe1982fb13c07c0a1bd4890661476911680f9
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5a94ad29759eec227b6f4f982d1083d6d
SHA11b50109ba433cb17d38b74dd24ad74f00b1110b6
SHA25664c9c06ad7f904ed9de0f493e329b764f082993cb65e37691f10ba626df1e686
SHA512e4351954cb23c049be9a76d5e243bcdfd20cc79d3ecacd85cbc49cdcf009255c687d32d13f243e26bfdf93a80f85a1730c30bde6ce5dc5712b9ae5748ac5c0d3
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5a94ad29759eec227b6f4f982d1083d6d
SHA11b50109ba433cb17d38b74dd24ad74f00b1110b6
SHA25664c9c06ad7f904ed9de0f493e329b764f082993cb65e37691f10ba626df1e686
SHA512e4351954cb23c049be9a76d5e243bcdfd20cc79d3ecacd85cbc49cdcf009255c687d32d13f243e26bfdf93a80f85a1730c30bde6ce5dc5712b9ae5748ac5c0d3
-
\PerfLogs\backup.exeFilesize
72KB
MD56fef79ff83cf16120f70c7fc3a5e8a85
SHA1d96b75c22f8cd68f5d99e0ea0f704e631a96664c
SHA2568979c6915e7a2d1016576022ad3a4fc9bb01e683d7b01a7e051bcfc2eb817cdd
SHA512f321e8634d4321e1e876e04cc2bddf9afa77d08e0e5273ae070570b7340b68d1d54be2c38547f61efcbb4eb66b9902222121ed4144b3964582229a83bfc90fb1
-
\PerfLogs\backup.exeFilesize
72KB
MD56fef79ff83cf16120f70c7fc3a5e8a85
SHA1d96b75c22f8cd68f5d99e0ea0f704e631a96664c
SHA2568979c6915e7a2d1016576022ad3a4fc9bb01e683d7b01a7e051bcfc2eb817cdd
SHA512f321e8634d4321e1e876e04cc2bddf9afa77d08e0e5273ae070570b7340b68d1d54be2c38547f61efcbb4eb66b9902222121ed4144b3964582229a83bfc90fb1
-
\Program Files\7-Zip\Lang\data.exeFilesize
72KB
MD53f6b1d8582e1acdb47303dc4736ca1eb
SHA138d2e39949416b79c177d5fcac94acb0b1e8d4f7
SHA256ff824113fc0b933990e3ae9859dc759869e6c6cb11d1879f47bf5b50fa8c144b
SHA5127c95696e5d884b9528b2bb16c1fc7b88fa1d4a55313529c4488f71ff413663669c2a11e3789ef99260ad5614dc0dd84a07d64fb21716efc202b0dbb85c33e043
-
\Program Files\7-Zip\Lang\data.exeFilesize
72KB
MD53f6b1d8582e1acdb47303dc4736ca1eb
SHA138d2e39949416b79c177d5fcac94acb0b1e8d4f7
SHA256ff824113fc0b933990e3ae9859dc759869e6c6cb11d1879f47bf5b50fa8c144b
SHA5127c95696e5d884b9528b2bb16c1fc7b88fa1d4a55313529c4488f71ff413663669c2a11e3789ef99260ad5614dc0dd84a07d64fb21716efc202b0dbb85c33e043
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e369319685b2f1dd1c4cb9be5595a07d
SHA1aa22832545fba713bf5afe1c9c0c3c2d5bbeeca4
SHA2561877ff32bacdb2b82eefafa385d2ece34c76d821507c3bd9b2512c58b52d63c6
SHA51297c07c3c6b86f5dc99dc96d89969d67e0d7daec990efdc5c2b1ee46d1e1c55c312ba4ad1c4531bb6bda5c9b7208dffa9fbaddc4835c1dc2017be293d27beda34
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e369319685b2f1dd1c4cb9be5595a07d
SHA1aa22832545fba713bf5afe1c9c0c3c2d5bbeeca4
SHA2561877ff32bacdb2b82eefafa385d2ece34c76d821507c3bd9b2512c58b52d63c6
SHA51297c07c3c6b86f5dc99dc96d89969d67e0d7daec990efdc5c2b1ee46d1e1c55c312ba4ad1c4531bb6bda5c9b7208dffa9fbaddc4835c1dc2017be293d27beda34
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD52673293f6b47f2318cdbd6c74a5af469
SHA1ff222238636a31f1dc947b6d7e0ee19bcfb35e02
SHA2567daa9d72f6e4903a9e912654ad82228d9ff5b398df371dc0122819f8fa6707ee
SHA5125d47877e1c5e0b329817ec46362e5451d1c973c991ae6d36e531368229efd07edec91525654d43df073b39303fee0f0e368b6af3bffc7de57945606053c245e3
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exeFilesize
72KB
MD5e096f14f1e62a1b3f8f7bb7bff86fa18
SHA12dabf18d92f7da2932ff6aa21aa26ef0b2fbb61d
SHA2567e9040ee861a261a340263604988fabbf4dce70c60a5d8070ab89733a1de44d2
SHA512c6e8abe352f973312263dcf4fec562ea821c92ad3424e5e4a3ec3a1e5a03f8b03ef9ec0240a08e068fad8e305703eb6e193cf2eccb136194b148fd86bf85ee09
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD56a3e6418d3586804ddd2054c74fa251b
SHA1d136bdffcb105e696a9160c6ce9c1250abbd27f6
SHA25693e909c40cffd8e109c7003e52b2c6f52af20524d5546de341058e6f9bee0ede
SHA512dd75eb8db1b55451c8359a9b69d5d7962450fa0a074d1c5f4af1a813da6470ee395a21b874a8dcb604681c7200037834582c6720076bb07cac9e6fc8b16cdfc9
-
\Program Files\backup.exeFilesize
72KB
MD54c685b177cd545331d95a0db89764508
SHA1620aec2ade0d2b0d6ad9cfddad05a69199caa76c
SHA25655e53732919f9eaef738d0e0703b37d7cf74f262c9e29ed915b8ef3432abd2b4
SHA512b3b401388f70b41f027fb26810cc7f31f438367715ea996f7c23769fd65f8f3ca0c83911e74338641168899f694e1a05dcfec3a5dd0dba3b250d9961de481584
-
\Program Files\backup.exeFilesize
72KB
MD54c685b177cd545331d95a0db89764508
SHA1620aec2ade0d2b0d6ad9cfddad05a69199caa76c
SHA25655e53732919f9eaef738d0e0703b37d7cf74f262c9e29ed915b8ef3432abd2b4
SHA512b3b401388f70b41f027fb26810cc7f31f438367715ea996f7c23769fd65f8f3ca0c83911e74338641168899f694e1a05dcfec3a5dd0dba3b250d9961de481584
-
\Users\Admin\AppData\Local\Temp\734086432\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
\Users\Admin\AppData\Local\Temp\734086432\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD5b7eb0fb6892da6acb5cdb116238a5e5b
SHA181bbda5c0b9b897ed98cb04a41daa403a613ea10
SHA256676f54d7475b2e436f70079eaace5fca36c6f2ea80f98e8e959d222dadc012ee
SHA512df56e37d1961132c30c05b3bfa0153ffbd1e8b0428fbd936144502f43b5cac508c0983be17b06adfac2d481921a5dd79237f3f04bbcbf965225ee44621c5ab2a
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD5b7eb0fb6892da6acb5cdb116238a5e5b
SHA181bbda5c0b9b897ed98cb04a41daa403a613ea10
SHA256676f54d7475b2e436f70079eaace5fca36c6f2ea80f98e8e959d222dadc012ee
SHA512df56e37d1961132c30c05b3bfa0153ffbd1e8b0428fbd936144502f43b5cac508c0983be17b06adfac2d481921a5dd79237f3f04bbcbf965225ee44621c5ab2a
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5676781aea97463c725f22a06f3dc6338
SHA1e97a2757f9a50556beccc719340f220e9026eedd
SHA256c68c5e2d38957e6050da91f84f81e1c6ba0d85b84e5e1ad6ce29aca4e1df5eb5
SHA51203a13dcb89f022e84a3f7e80c7550ae1a7cdef7ba020c422ea5dcf8d02b38c241c27c5221faf6f6254342e15b5afd787f149aa74d9cd197adcbe6c2e78b71af2
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD50889a06e48cf36dcf9c8db4b86945784
SHA15aa431aad347819f46768b64a105849c107367f3
SHA256b6d5db8b292fcd9eb80ec3cda57d1165b38d67292b14d969b0751f5d0f033958
SHA5125b056ceb10c51e5178fd70db9fadfc8d29faa144b283ef92b549ef35b38b2bb763991bbf7fbecf92615f4389b78bdc62e6e3994ad4c02e39f0ed263c2b2c542e
-
memory/240-230-0x0000000000000000-mapping.dmp
-
memory/364-127-0x0000000000000000-mapping.dmp
-
memory/428-304-0x0000000000000000-mapping.dmp
-
memory/540-167-0x0000000000000000-mapping.dmp
-
memory/584-113-0x0000000000000000-mapping.dmp
-
memory/612-195-0x0000000000000000-mapping.dmp
-
memory/612-285-0x0000000000000000-mapping.dmp
-
memory/676-140-0x0000000000000000-mapping.dmp
-
memory/740-64-0x0000000000000000-mapping.dmp
-
memory/816-119-0x0000000000000000-mapping.dmp
-
memory/852-267-0x0000000000000000-mapping.dmp
-
memory/896-227-0x0000000000000000-mapping.dmp
-
memory/940-70-0x0000000000000000-mapping.dmp
-
memory/1052-242-0x0000000000000000-mapping.dmp
-
memory/1176-93-0x0000000000000000-mapping.dmp
-
memory/1176-301-0x0000000000000000-mapping.dmp
-
memory/1200-207-0x0000000000000000-mapping.dmp
-
memory/1220-210-0x0000000000000000-mapping.dmp
-
memory/1244-257-0x0000000000000000-mapping.dmp
-
memory/1312-88-0x0000000000000000-mapping.dmp
-
memory/1328-101-0x0000000000000000-mapping.dmp
-
memory/1328-295-0x0000000000000000-mapping.dmp
-
memory/1352-58-0x0000000000000000-mapping.dmp
-
memory/1388-233-0x0000000000000000-mapping.dmp
-
memory/1444-176-0x0000000000000000-mapping.dmp
-
memory/1484-107-0x0000000000000000-mapping.dmp
-
memory/1484-214-0x0000000000000000-mapping.dmp
-
memory/1496-260-0x0000000000000000-mapping.dmp
-
memory/1532-147-0x0000000000000000-mapping.dmp
-
memory/1536-307-0x0000000000000000-mapping.dmp
-
memory/1536-217-0x0000000000000000-mapping.dmp
-
memory/1572-186-0x0000000000000000-mapping.dmp
-
memory/1572-276-0x0000000000000000-mapping.dmp
-
memory/1576-239-0x0000000000000000-mapping.dmp
-
memory/1604-171-0x0000000000000000-mapping.dmp
-
memory/1624-221-0x0000000000000000-mapping.dmp
-
memory/1624-310-0x0000000000000000-mapping.dmp
-
memory/1636-76-0x0000000000000000-mapping.dmp
-
memory/1644-251-0x0000000000000000-mapping.dmp
-
memory/1676-279-0x0000000000000000-mapping.dmp
-
memory/1676-189-0x0000000000000000-mapping.dmp
-
memory/1716-160-0x0000000000000000-mapping.dmp
-
memory/1736-224-0x0000000000000000-mapping.dmp
-
memory/1736-313-0x0000000000000000-mapping.dmp
-
memory/1744-254-0x0000000000000000-mapping.dmp
-
memory/1748-81-0x0000000000000000-mapping.dmp
-
memory/1760-180-0x0000000000000000-mapping.dmp
-
memory/1760-270-0x0000000000000000-mapping.dmp
-
memory/1772-183-0x0000000000000000-mapping.dmp
-
memory/1772-273-0x0000000000000000-mapping.dmp
-
memory/1780-264-0x0000000000000000-mapping.dmp
-
memory/1800-236-0x0000000000000000-mapping.dmp
-
memory/1812-134-0x0000000000000000-mapping.dmp
-
memory/1824-248-0x0000000000000000-mapping.dmp
-
memory/1824-154-0x0000000000000000-mapping.dmp
-
memory/1860-192-0x0000000000000000-mapping.dmp
-
memory/1860-282-0x0000000000000000-mapping.dmp
-
memory/1864-288-0x0000000000000000-mapping.dmp
-
memory/1864-198-0x0000000000000000-mapping.dmp
-
memory/1868-201-0x0000000000000000-mapping.dmp
-
memory/1868-291-0x0000000000000000-mapping.dmp
-
memory/1872-298-0x0000000000000000-mapping.dmp
-
memory/1876-245-0x0000000000000000-mapping.dmp
-
memory/2020-177-0x00000000742A1000-0x00000000742A3000-memory.dmpFilesize
8KB
-
memory/2020-123-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/2036-204-0x0000000000000000-mapping.dmp