Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe
Resource
win10v2004-20221111-en
General
-
Target
59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe
-
Size
72KB
-
MD5
b14872d43b000e051aadd611182dd8ac
-
SHA1
bf7e17d44c99095df4748edb734286f83482b61e
-
SHA256
59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447
-
SHA512
dba272682dbe8e33dce635fdc432f57a3efed03262f0bd28ddeeafae36da1d1f16f7aea2aa4f4d2bf563fe18224ce6b5d9ddfd291f9b6cff7a68f48a6ba9cc4f
-
SSDEEP
384:N6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oG4:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrV
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe -
Executes dropped EXE 64 IoCs
pid Process 1008 data.exe 1584 backup.exe 1516 backup.exe 1680 backup.exe 760 backup.exe 1120 backup.exe 1280 backup.exe 1380 backup.exe 756 backup.exe 1520 backup.exe 1860 backup.exe 988 backup.exe 1072 backup.exe 1088 backup.exe 1260 System Restore.exe 1640 backup.exe 1876 backup.exe 1616 backup.exe 1208 backup.exe 1016 backup.exe 328 update.exe 1520 backup.exe 1960 backup.exe 1828 backup.exe 392 backup.exe 1568 backup.exe 2036 backup.exe 796 backup.exe 1636 backup.exe 240 backup.exe 1520 backup.exe 1728 backup.exe 328 backup.exe 564 backup.exe 1072 backup.exe 1284 backup.exe 1896 backup.exe 836 backup.exe 1952 backup.exe 1816 backup.exe 1788 backup.exe 1332 backup.exe 1968 backup.exe 972 backup.exe 1836 backup.exe 1040 backup.exe 556 update.exe 1720 backup.exe 876 backup.exe 1148 backup.exe 1000 backup.exe 1884 backup.exe 1016 backup.exe 796 backup.exe 392 backup.exe 1344 backup.exe 1728 backup.exe 1964 backup.exe 1568 System Restore.exe 1536 backup.exe 1848 backup.exe 276 backup.exe 688 data.exe 552 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 1380 backup.exe 1380 backup.exe 756 backup.exe 756 backup.exe 1380 backup.exe 1380 backup.exe 1860 backup.exe 1860 backup.exe 988 backup.exe 988 backup.exe 1860 backup.exe 1860 backup.exe 1088 backup.exe 1088 backup.exe 1260 System Restore.exe 1260 System Restore.exe 1260 System Restore.exe 1260 System Restore.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 328 update.exe 328 update.exe 328 update.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 340 backup.exe 1380 backup.exe 1380 backup.exe 1088 backup.exe 1088 backup.exe 1260 System Restore.exe 1860 backup.exe 1860 backup.exe 1260 System Restore.exe 2036 backup.exe 2036 backup.exe 240 backup.exe 240 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe File opened for modification C:\Windows\CSC\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\System Restore.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 1008 data.exe 1584 backup.exe 1516 backup.exe 1680 backup.exe 760 backup.exe 1120 backup.exe 1280 backup.exe 1380 backup.exe 756 backup.exe 1520 backup.exe 1860 backup.exe 988 backup.exe 1072 backup.exe 1088 backup.exe 1260 System Restore.exe 1640 backup.exe 1788 System Restore.exe 1660 backup.exe 956 backup.exe 1332 backup.exe 316 backup.exe 1544 backup.exe 1680 backup.exe 1176 backup.exe 1040 backup.exe 868 backup.exe 1784 backup.exe 340 backup.exe 1616 backup.exe 1208 backup.exe 1016 backup.exe 328 update.exe 1520 backup.exe 1960 backup.exe 1828 backup.exe 392 backup.exe 1568 backup.exe 988 backup.exe 1672 backup.exe 1952 backup.exe 1324 backup.exe 688 backup.exe 1276 backup.exe 2012 backup.exe 1428 backup.exe 1740 backup.exe 624 backup.exe 1584 System Restore.exe 1708 backup.exe 952 backup.exe 960 backup.exe 1836 backup.exe 916 backup.exe 940 System Restore.exe 1720 backup.exe 748 backup.exe 1104 backup.exe 1300 backup.exe 2036 backup.exe 796 backup.exe 1636 backup.exe 240 backup.exe 1520 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1008 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 28 PID 2032 wrote to memory of 1008 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 28 PID 2032 wrote to memory of 1008 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 28 PID 2032 wrote to memory of 1008 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 28 PID 2032 wrote to memory of 1584 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 29 PID 2032 wrote to memory of 1584 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 29 PID 2032 wrote to memory of 1584 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 29 PID 2032 wrote to memory of 1584 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 29 PID 2032 wrote to memory of 1516 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 30 PID 2032 wrote to memory of 1516 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 30 PID 2032 wrote to memory of 1516 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 30 PID 2032 wrote to memory of 1516 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 30 PID 2032 wrote to memory of 1680 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 31 PID 2032 wrote to memory of 1680 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 31 PID 2032 wrote to memory of 1680 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 31 PID 2032 wrote to memory of 1680 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 31 PID 2032 wrote to memory of 760 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 32 PID 2032 wrote to memory of 760 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 32 PID 2032 wrote to memory of 760 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 32 PID 2032 wrote to memory of 760 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 32 PID 2032 wrote to memory of 1120 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 33 PID 2032 wrote to memory of 1120 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 33 PID 2032 wrote to memory of 1120 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 33 PID 2032 wrote to memory of 1120 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 33 PID 2032 wrote to memory of 1280 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 34 PID 2032 wrote to memory of 1280 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 34 PID 2032 wrote to memory of 1280 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 34 PID 2032 wrote to memory of 1280 2032 59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe 34 PID 1008 wrote to memory of 1380 1008 data.exe 35 PID 1008 wrote to memory of 1380 1008 data.exe 35 PID 1008 wrote to memory of 1380 1008 data.exe 35 PID 1008 wrote to memory of 1380 1008 data.exe 35 PID 1380 wrote to memory of 756 1380 backup.exe 36 PID 1380 wrote to memory of 756 1380 backup.exe 36 PID 1380 wrote to memory of 756 1380 backup.exe 36 PID 1380 wrote to memory of 756 1380 backup.exe 36 PID 756 wrote to memory of 1520 756 backup.exe 37 PID 756 wrote to memory of 1520 756 backup.exe 37 PID 756 wrote to memory of 1520 756 backup.exe 37 PID 756 wrote to memory of 1520 756 backup.exe 37 PID 1380 wrote to memory of 1860 1380 backup.exe 38 PID 1380 wrote to memory of 1860 1380 backup.exe 38 PID 1380 wrote to memory of 1860 1380 backup.exe 38 PID 1380 wrote to memory of 1860 1380 backup.exe 38 PID 1860 wrote to memory of 988 1860 backup.exe 39 PID 1860 wrote to memory of 988 1860 backup.exe 39 PID 1860 wrote to memory of 988 1860 backup.exe 39 PID 1860 wrote to memory of 988 1860 backup.exe 39 PID 988 wrote to memory of 1072 988 backup.exe 40 PID 988 wrote to memory of 1072 988 backup.exe 40 PID 988 wrote to memory of 1072 988 backup.exe 40 PID 988 wrote to memory of 1072 988 backup.exe 40 PID 1860 wrote to memory of 1088 1860 backup.exe 41 PID 1860 wrote to memory of 1088 1860 backup.exe 41 PID 1860 wrote to memory of 1088 1860 backup.exe 41 PID 1860 wrote to memory of 1088 1860 backup.exe 41 PID 1088 wrote to memory of 1260 1088 backup.exe 42 PID 1088 wrote to memory of 1260 1088 backup.exe 42 PID 1088 wrote to memory of 1260 1088 backup.exe 42 PID 1088 wrote to memory of 1260 1088 backup.exe 42 PID 1260 wrote to memory of 1640 1260 System Restore.exe 43 PID 1260 wrote to memory of 1640 1260 System Restore.exe 43 PID 1260 wrote to memory of 1640 1260 System Restore.exe 43 PID 1260 wrote to memory of 1640 1260 System Restore.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe"C:\Users\Admin\AppData\Local\Temp\59e2621a2b0e2c04a287fc688df3f9d92ae54a2f803ea34819dc5655e14a1447.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\1380967902\data.exeC:\Users\Admin\AppData\Local\Temp\1380967902\data.exe C:\Users\Admin\AppData\Local\Temp\1380967902\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:756 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1520
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1072
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files\Common Files\Microsoft Shared\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1260 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- System policy modification
PID:1876 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Suspicious use of SetWindowsHookEx
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:316
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Suspicious use of SetWindowsHookEx
PID:868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:340 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1208
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1828
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:392
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1568
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Suspicious use of SetWindowsHookEx
PID:988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Suspicious use of SetWindowsHookEx
PID:1428
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Suspicious use of SetWindowsHookEx
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Suspicious use of SetWindowsHookEx
PID:960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Suspicious use of SetWindowsHookEx
PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Suspicious use of SetWindowsHookEx
PID:1300
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵PID:1164
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
PID:1808
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:1264
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:520
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- System policy modification
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1072
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Executes dropped EXE
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
PID:796 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Executes dropped EXE
PID:1344
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1848
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1512 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- System policy modification
PID:1280
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- System policy modification
PID:556
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:992
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1808
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1640
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- System policy modification
PID:280
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:276 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- System policy modification
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1016
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- System policy modification
PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1408
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1164
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- System policy modification
PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1592 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:2052
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:796
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:564 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1816
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1968 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1720 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Executes dropped EXE
PID:1148
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Executes dropped EXE
- System policy modification
PID:1016
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1964
-
-
C:\Program Files\Common Files\System\ado\fr-FR\data.exe"C:\Program Files\Common Files\System\ado\fr-FR\data.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Executes dropped EXE
PID:688
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1584
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
PID:1708
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- System policy modification
PID:940
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:876
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1408
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
PID:1884
-
-
C:\Program Files\Common Files\System\it-IT\data.exe"C:\Program Files\Common Files\System\it-IT\data.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1736
-
-
C:\Program Files\Common Files\System\ja-JP\System Restore.exe"C:\Program Files\Common Files\System\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- System policy modification
PID:1364
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Drops file in Program Files directory
PID:1660 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1816
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵PID:1332
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- System policy modification
PID:468
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\data.exe"C:\Program Files\Common Files\System\msadc\fr-FR\data.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵
- System policy modification
PID:1624
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1884
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:1940
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1052 -
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:1300
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵PID:1532
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵PID:1164
-
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵PID:1280
-
-
C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵PID:1276
-
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1520
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- System policy modification
PID:1952
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:972
-
-
C:\Program Files\DVD Maker\fr-FR\update.exe"C:\Program Files\DVD Maker\fr-FR\update.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Executes dropped EXE
- System policy modification
PID:556
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Executes dropped EXE
PID:1000
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Executes dropped EXE
- System policy modification
PID:392
-
-
C:\Program Files\DVD Maker\Shared\System Restore.exe"C:\Program Files\DVD Maker\Shared\System Restore.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Executes dropped EXE
- System policy modification
PID:1568 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
PID:564 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- System policy modification
PID:468
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:888
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:612
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- System policy modification
PID:1952
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- System policy modification
PID:864
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- System policy modification
PID:1972
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- System policy modification
PID:632
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- Modifies visibility of file extensions in Explorer
PID:560
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1512
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:1812
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:1740
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:824
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:2060
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
PID:1028 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1144
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:624 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1736
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:748
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1428
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:888
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:560
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:680
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:328 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1896 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
PID:1788
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1836 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:876
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1884
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Executes dropped EXE
- System policy modification
PID:1728
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Executes dropped EXE
- System policy modification
PID:1536 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Executes dropped EXE
PID:276
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
PID:1940
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1876
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:1176
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1684
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1148
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1960 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1016
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Drops file in Program Files directory
PID:1592 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:1712
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:520
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1876
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Modifies visibility of file extensions in Explorer
PID:1772
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Drops file in Program Files directory
- System policy modification
PID:1104 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
PID:520
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
PID:1960 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:1524
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- System policy modification
PID:280
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:760
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1728 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1656
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1116
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:316
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1624
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1848
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:960 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:1000
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1020 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
PID:1560 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1576
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1468
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:280
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:328
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1720
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1964
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1952
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1640 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
PID:868
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1784
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:552
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1620
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1520 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:960
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:2072
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe"C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2080
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:988 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1708
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:432
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1456
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1816
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1336 -
C:\Windows\addins\System Restore.exe"C:\Windows\addins\System Restore.exe" C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1620
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
- System policy modification
PID:2012
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:864
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1652
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:540
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:1260
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1280
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD576be7c22976bbfd6f75d976befaa6e68
SHA195cb81e5bf01ab29c09f43f923515bc93faa723b
SHA2560721448cba844e31587bc3f4c334cba5c2b02187b733e32ac1d6c76e25015351
SHA512dac8a3b3dda005c27f2fc008c2e0030dc012978ddfc0c7ed891c2bce800c688626be4bb38b138e99752c9a8828322474508e6c80bfbb62eb39a4ee2935ff918d
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD5d5dc76ee654bf50b2e36a17e3b55c65e
SHA1ed16ded3c742072d9ffb96b60a05d74671ef4fb0
SHA256a5e260f3dd8c0f8a4bccd54045bfa14cfc120ff9523f34d4574fedb0f2094887
SHA512d0580cf1625dcc7a6b31cb4d6bf74f17849829b4c1f7be878bb9d0e9f401a628012ea2347b5e3a31efae129da59a9f51621a6239780f0041b871b7570f7b7985
-
Filesize
72KB
MD5cfe9ac1f0cf04789fb7b55794b9bbffa
SHA147f0202d43e3b7d9fe1f7c3c4527318ae4700bb7
SHA256198383344fb300febf753084a3e9f77f1aeea254a16a575e04500ee0acbbf930
SHA512de94175417037963114090f18b960d6f2402a12c2ba5d44b89593efbc52a887d55267d59365866c773c9a7408759808dca98a2bf5add8c4c77b6ab40c0f8ff0e
-
Filesize
72KB
MD5cfe9ac1f0cf04789fb7b55794b9bbffa
SHA147f0202d43e3b7d9fe1f7c3c4527318ae4700bb7
SHA256198383344fb300febf753084a3e9f77f1aeea254a16a575e04500ee0acbbf930
SHA512de94175417037963114090f18b960d6f2402a12c2ba5d44b89593efbc52a887d55267d59365866c773c9a7408759808dca98a2bf5add8c4c77b6ab40c0f8ff0e
-
Filesize
72KB
MD5d5dc76ee654bf50b2e36a17e3b55c65e
SHA1ed16ded3c742072d9ffb96b60a05d74671ef4fb0
SHA256a5e260f3dd8c0f8a4bccd54045bfa14cfc120ff9523f34d4574fedb0f2094887
SHA512d0580cf1625dcc7a6b31cb4d6bf74f17849829b4c1f7be878bb9d0e9f401a628012ea2347b5e3a31efae129da59a9f51621a6239780f0041b871b7570f7b7985
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD52e04fed8bf09abc9dcaca43ae839a732
SHA12ebfbe697b6a6878190ec5d9ed4a96631b65b3fe
SHA2569b439ae02e58a320185ca768cc170643f48cf3610a70c93c67f2b54f03695ff4
SHA5123f34a96268f3e47384cf4014447839aa73c1ec4f0b1ee068af2d596eb023ed6074dbc37b6463688060cdcb47382ba569c9b73bc761164ceeac766b626e16cad5
-
Filesize
72KB
MD52e04fed8bf09abc9dcaca43ae839a732
SHA12ebfbe697b6a6878190ec5d9ed4a96631b65b3fe
SHA2569b439ae02e58a320185ca768cc170643f48cf3610a70c93c67f2b54f03695ff4
SHA5123f34a96268f3e47384cf4014447839aa73c1ec4f0b1ee068af2d596eb023ed6074dbc37b6463688060cdcb47382ba569c9b73bc761164ceeac766b626e16cad5
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5abb3b1c52f9e1ee9564ce3daae55c4f6
SHA17c7721d1d00dedce48e1ef366a3335f0a839f6ae
SHA256078d56afc2163557a5afd60136000e25fd726c52249ee263dbc752b22e7ffcdb
SHA512f6140bccd70770f2565efda3fa7b0d75f12a4d7a40b2d4e695bfe3d7860baa65e325b92c3bb0393b1d5d3a315501d9bede0c96a41042e48462b7d993189da2a2
-
Filesize
72KB
MD5abb3b1c52f9e1ee9564ce3daae55c4f6
SHA17c7721d1d00dedce48e1ef366a3335f0a839f6ae
SHA256078d56afc2163557a5afd60136000e25fd726c52249ee263dbc752b22e7ffcdb
SHA512f6140bccd70770f2565efda3fa7b0d75f12a4d7a40b2d4e695bfe3d7860baa65e325b92c3bb0393b1d5d3a315501d9bede0c96a41042e48462b7d993189da2a2
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD576be7c22976bbfd6f75d976befaa6e68
SHA195cb81e5bf01ab29c09f43f923515bc93faa723b
SHA2560721448cba844e31587bc3f4c334cba5c2b02187b733e32ac1d6c76e25015351
SHA512dac8a3b3dda005c27f2fc008c2e0030dc012978ddfc0c7ed891c2bce800c688626be4bb38b138e99752c9a8828322474508e6c80bfbb62eb39a4ee2935ff918d
-
Filesize
72KB
MD576be7c22976bbfd6f75d976befaa6e68
SHA195cb81e5bf01ab29c09f43f923515bc93faa723b
SHA2560721448cba844e31587bc3f4c334cba5c2b02187b733e32ac1d6c76e25015351
SHA512dac8a3b3dda005c27f2fc008c2e0030dc012978ddfc0c7ed891c2bce800c688626be4bb38b138e99752c9a8828322474508e6c80bfbb62eb39a4ee2935ff918d
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD529d98553b11060015a166bc1cc728093
SHA1a28b8fe56b985588ad7e9dffee65f7497d9028ed
SHA25680aab600a12fabc76b167cd558edf4fe28249f033c115c5de033f112bbc31a0e
SHA512266e6c49872c0afd6ab50402eb6019e9ce5ad62c430711cf3539b89b4cfcb4e7bca6aa9c00956501412afe6422966556796324f26496d3781b27f3937c5ea26d
-
Filesize
72KB
MD5d5dc76ee654bf50b2e36a17e3b55c65e
SHA1ed16ded3c742072d9ffb96b60a05d74671ef4fb0
SHA256a5e260f3dd8c0f8a4bccd54045bfa14cfc120ff9523f34d4574fedb0f2094887
SHA512d0580cf1625dcc7a6b31cb4d6bf74f17849829b4c1f7be878bb9d0e9f401a628012ea2347b5e3a31efae129da59a9f51621a6239780f0041b871b7570f7b7985
-
Filesize
72KB
MD5d5dc76ee654bf50b2e36a17e3b55c65e
SHA1ed16ded3c742072d9ffb96b60a05d74671ef4fb0
SHA256a5e260f3dd8c0f8a4bccd54045bfa14cfc120ff9523f34d4574fedb0f2094887
SHA512d0580cf1625dcc7a6b31cb4d6bf74f17849829b4c1f7be878bb9d0e9f401a628012ea2347b5e3a31efae129da59a9f51621a6239780f0041b871b7570f7b7985
-
Filesize
72KB
MD5cfe9ac1f0cf04789fb7b55794b9bbffa
SHA147f0202d43e3b7d9fe1f7c3c4527318ae4700bb7
SHA256198383344fb300febf753084a3e9f77f1aeea254a16a575e04500ee0acbbf930
SHA512de94175417037963114090f18b960d6f2402a12c2ba5d44b89593efbc52a887d55267d59365866c773c9a7408759808dca98a2bf5add8c4c77b6ab40c0f8ff0e
-
Filesize
72KB
MD5cfe9ac1f0cf04789fb7b55794b9bbffa
SHA147f0202d43e3b7d9fe1f7c3c4527318ae4700bb7
SHA256198383344fb300febf753084a3e9f77f1aeea254a16a575e04500ee0acbbf930
SHA512de94175417037963114090f18b960d6f2402a12c2ba5d44b89593efbc52a887d55267d59365866c773c9a7408759808dca98a2bf5add8c4c77b6ab40c0f8ff0e
-
Filesize
72KB
MD5d5dc76ee654bf50b2e36a17e3b55c65e
SHA1ed16ded3c742072d9ffb96b60a05d74671ef4fb0
SHA256a5e260f3dd8c0f8a4bccd54045bfa14cfc120ff9523f34d4574fedb0f2094887
SHA512d0580cf1625dcc7a6b31cb4d6bf74f17849829b4c1f7be878bb9d0e9f401a628012ea2347b5e3a31efae129da59a9f51621a6239780f0041b871b7570f7b7985
-
Filesize
72KB
MD5d5dc76ee654bf50b2e36a17e3b55c65e
SHA1ed16ded3c742072d9ffb96b60a05d74671ef4fb0
SHA256a5e260f3dd8c0f8a4bccd54045bfa14cfc120ff9523f34d4574fedb0f2094887
SHA512d0580cf1625dcc7a6b31cb4d6bf74f17849829b4c1f7be878bb9d0e9f401a628012ea2347b5e3a31efae129da59a9f51621a6239780f0041b871b7570f7b7985
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD5b42248523ec59d7245b21b1be4489c9f
SHA154ad137d31b3b917d758ff91d675f0ac4824b987
SHA2561e61828356af4d21803650bb426bf2f89e2856ff1aa56d738490da0d8ea905bf
SHA512fbdd8dca04f558d8ef89162f3bb9385ca09518634bfaa69dbd990028545aa2bed6d9d1445e615abcd2a1a03f8433ba37dd10265527a4dcb5b9215bcef11ab330
-
Filesize
72KB
MD52e04fed8bf09abc9dcaca43ae839a732
SHA12ebfbe697b6a6878190ec5d9ed4a96631b65b3fe
SHA2569b439ae02e58a320185ca768cc170643f48cf3610a70c93c67f2b54f03695ff4
SHA5123f34a96268f3e47384cf4014447839aa73c1ec4f0b1ee068af2d596eb023ed6074dbc37b6463688060cdcb47382ba569c9b73bc761164ceeac766b626e16cad5
-
Filesize
72KB
MD52e04fed8bf09abc9dcaca43ae839a732
SHA12ebfbe697b6a6878190ec5d9ed4a96631b65b3fe
SHA2569b439ae02e58a320185ca768cc170643f48cf3610a70c93c67f2b54f03695ff4
SHA5123f34a96268f3e47384cf4014447839aa73c1ec4f0b1ee068af2d596eb023ed6074dbc37b6463688060cdcb47382ba569c9b73bc761164ceeac766b626e16cad5
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD50a6d104e4694eda90a50c604d3260123
SHA1499ad1abafe98f60ccc5706ed3bc4bb94e327618
SHA256095daf2559013808a5c0f6b42d63c2904cea3bdb2112031b7b98ac2bc9f4db68
SHA5127f83ada94028f96e64d29093b05c00ca7173d847e9cb8c799c8c9b2a5531b7f957c4f8c12e0568884280e041ed0e0304ac7aeeab8b7b8fb90d61d4f1c632d8ab
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5c690875df6776d1766514d867c2f2b0a
SHA134a2853c63578a104a9ca3cd06aaae8fa941ae1d
SHA256abdf5fc8a02c4922c3447e77af857a4eb584082257bc9e13286b41859844cdd5
SHA512d96d988a393b6aa83bda822f3b5ed89a6d102838794c04a2088b82236cc4f3705e06cafcdb24a100b529f04cbead877bde83523f485213b6f6e1972ec6ab88c0
-
Filesize
72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d
-
Filesize
72KB
MD5a78cb0b1d739b31801aec936a3fe87d0
SHA1dff42b58ecc5f2f876e8508c5435d0e3c50e4502
SHA25672379d8c74169d351544a47a69f91a76d7a89442f5a4d240ffed376757c00d62
SHA512831d766abe6b7af535244b9bbfbaf4df0a1e6a9048b64ca771205a27a8f3dd4d76cc448915bccb3df0a28b0408365e6d13a67f5e33c23ba6222ebe49a71d816d