Analysis
-
max time kernel
138s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 20:02
Behavioral task
behavioral1
Sample
NEAS.2464e544067dcd3a8d6874cce174b020.exe
Resource
win7-20230831-en
General
-
Target
NEAS.2464e544067dcd3a8d6874cce174b020.exe
-
Size
84KB
-
MD5
2464e544067dcd3a8d6874cce174b020
-
SHA1
92d7f55df2651d623b91a1776ea72ff9d8b6e86c
-
SHA256
02bf5a2a69f7bbbb87510ac540f899b3a76bef353ee6a7fd392651f2b5109191
-
SHA512
332388b0036b7fdb935f15194d6cde2ebe584a840d940d131235145f5a5c30f96b81e6e4c63efff8f6441dbe3a2ec3cbd2207fd45aec86c23c387b798c65c361
-
SSDEEP
768:/pQNwC3BESe4Vqth+0V5vKmyLylze70wi3BEme:BeT7BVwxfvEFwjRe
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" NEAS.2464e544067dcd3a8d6874cce174b020.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe -
Executes dropped EXE 64 IoCs
pid Process 2920 backup.exe 2696 backup.exe 2596 backup.exe 940 update.exe 2532 backup.exe 2284 backup.exe 1656 backup.exe 772 backup.exe 584 data.exe 1752 backup.exe 2152 backup.exe 2148 backup.exe 1056 backup.exe 952 backup.exe 2308 update.exe 3052 backup.exe 2336 backup.exe 1808 data.exe 1188 backup.exe 2020 backup.exe 2404 backup.exe 2452 backup.exe 2096 backup.exe 2264 backup.exe 2572 backup.exe 1612 backup.exe 2620 backup.exe 2644 backup.exe 2728 backup.exe 2652 data.exe 940 backup.exe 2544 backup.exe 2524 backup.exe 2476 data.exe 1532 backup.exe 2668 backup.exe 2908 backup.exe 1768 backup.exe 2240 backup.exe 1692 backup.exe 1892 backup.exe 1064 backup.exe 864 backup.exe 1720 backup.exe 632 backup.exe 812 backup.exe 2292 backup.exe 2184 backup.exe 1552 backup.exe 836 backup.exe 2976 backup.exe 2164 backup.exe 1796 backup.exe 2088 data.exe 2312 backup.exe 2244 backup.exe 1816 backup.exe 2144 backup.exe 2836 backup.exe 2632 backup.exe 2620 backup.exe 2648 backup.exe 2608 backup.exe 3024 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 940 update.exe 940 update.exe 940 update.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 772 backup.exe 772 backup.exe 584 data.exe 584 data.exe 772 backup.exe 772 backup.exe 2152 backup.exe 2152 backup.exe 2148 backup.exe 2148 backup.exe 2152 backup.exe 2152 backup.exe 952 backup.exe 2308 update.exe 2308 update.exe 2308 update.exe 2308 update.exe 2308 update.exe 3052 backup.exe 3052 backup.exe 3052 backup.exe 2308 update.exe 2308 update.exe 2336 backup.exe 2336 backup.exe 2336 backup.exe 2336 backup.exe 2336 backup.exe 1808 data.exe 1808 data.exe 1808 data.exe 2336 backup.exe 2336 backup.exe 1188 backup.exe 1188 backup.exe 1188 backup.exe 2336 backup.exe 2336 backup.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 2336 backup.exe 2336 backup.exe 2404 backup.exe 2404 backup.exe 2404 backup.exe 2336 backup.exe 2336 backup.exe -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0035000000014215-5.dat upx behavioral1/files/0x0035000000014215-9.dat upx behavioral1/files/0x0035000000014215-7.dat upx behavioral1/files/0x0035000000014215-12.dat upx behavioral1/memory/2920-13-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x00070000000143ba-17.dat upx behavioral1/files/0x00070000000143ba-19.dat upx behavioral1/files/0x00070000000143ba-23.dat upx behavioral1/memory/2696-27-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x000900000001472c-28.dat upx behavioral1/files/0x000900000001472c-34.dat upx behavioral1/files/0x000900000001472c-30.dat upx behavioral1/files/0x0008000000014486-39.dat upx behavioral1/files/0x0008000000014486-43.dat upx behavioral1/files/0x0008000000014486-42.dat upx behavioral1/memory/2372-44-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0008000000014486-46.dat upx behavioral1/files/0x0008000000014486-45.dat upx behavioral1/memory/2920-49-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0008000000014486-48.dat upx behavioral1/memory/940-56-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x00060000000149d7-54.dat upx behavioral1/files/0x00060000000149d7-57.dat upx behavioral1/files/0x00060000000149d7-61.dat upx behavioral1/files/0x000900000001495e-75.dat upx behavioral1/memory/2532-73-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x000900000001495e-69.dat upx behavioral1/files/0x000900000001495e-67.dat upx behavioral1/memory/2596-76-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2284-80-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0006000000014aa6-81.dat upx behavioral1/files/0x0006000000014aa6-83.dat upx behavioral1/files/0x0006000000014aa6-87.dat upx behavioral1/files/0x0035000000014215-90.dat upx behavioral1/memory/1656-91-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x001000000001422f-97.dat upx behavioral1/memory/2920-98-0x00000000002F0000-0x000000000030C000-memory.dmp upx behavioral1/files/0x001000000001422f-102.dat upx behavioral1/files/0x0006000000014b9b-106.dat upx behavioral1/files/0x0006000000014b9b-104.dat upx behavioral1/files/0x0006000000014b9b-111.dat upx behavioral1/files/0x0006000000014b9b-118.dat upx behavioral1/files/0x0006000000014fae-127.dat upx behavioral1/files/0x0006000000014fae-122.dat upx behavioral1/files/0x0006000000014fae-120.dat upx behavioral1/files/0x0007000000015319-136.dat upx behavioral1/memory/584-133-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1752-132-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0007000000015319-134.dat upx behavioral1/files/0x0007000000015319-141.dat upx behavioral1/memory/2372-142-0x0000000000270000-0x000000000028C000-memory.dmp upx behavioral1/memory/772-140-0x0000000000270000-0x000000000028C000-memory.dmp upx behavioral1/memory/2152-146-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0007000000015319-148.dat upx behavioral1/files/0x0006000000015478-150.dat upx behavioral1/files/0x0006000000015478-153.dat upx behavioral1/files/0x0006000000015478-162.dat upx behavioral1/files/0x0006000000015478-173.dat upx behavioral1/files/0x00070000000155ed-175.dat upx behavioral1/memory/772-176-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x00070000000155ed-179.dat upx behavioral1/files/0x00070000000155ed-184.dat upx behavioral1/memory/2148-188-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\data.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe update.exe File opened for modification C:\Program Files\VideoLAN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Update\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Windows Defender\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\Chess\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe update.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\backup.exe update.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\update.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 2920 backup.exe 2696 backup.exe 2596 backup.exe 940 update.exe 2532 backup.exe 2284 backup.exe 1656 backup.exe 772 backup.exe 584 data.exe 1752 backup.exe 2152 backup.exe 2148 backup.exe 1056 backup.exe 952 backup.exe 2308 update.exe 3052 backup.exe 2336 backup.exe 1808 data.exe 1188 backup.exe 2020 backup.exe 2404 backup.exe 2452 backup.exe 2096 backup.exe 2264 backup.exe 2572 backup.exe 1612 backup.exe 2620 backup.exe 2644 backup.exe 2728 backup.exe 2652 data.exe 940 backup.exe 2544 backup.exe 2524 backup.exe 2476 data.exe 1532 backup.exe 2668 backup.exe 2908 backup.exe 1768 backup.exe 2240 backup.exe 1692 backup.exe 1892 backup.exe 1064 backup.exe 864 backup.exe 1720 backup.exe 632 backup.exe 812 backup.exe 2292 backup.exe 2184 backup.exe 1552 backup.exe 836 backup.exe 2976 backup.exe 2164 backup.exe 1796 backup.exe 2088 data.exe 2312 backup.exe 2244 backup.exe 1816 backup.exe 2144 backup.exe 2836 backup.exe 2632 backup.exe 2620 backup.exe 2648 backup.exe 2608 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2920 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 28 PID 2372 wrote to memory of 2920 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 28 PID 2372 wrote to memory of 2920 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 28 PID 2372 wrote to memory of 2920 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 28 PID 2372 wrote to memory of 2696 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 29 PID 2372 wrote to memory of 2696 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 29 PID 2372 wrote to memory of 2696 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 29 PID 2372 wrote to memory of 2696 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 29 PID 2372 wrote to memory of 2596 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 30 PID 2372 wrote to memory of 2596 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 30 PID 2372 wrote to memory of 2596 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 30 PID 2372 wrote to memory of 2596 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 30 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 940 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 31 PID 2372 wrote to memory of 2532 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 32 PID 2372 wrote to memory of 2532 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 32 PID 2372 wrote to memory of 2532 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 32 PID 2372 wrote to memory of 2532 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 32 PID 2372 wrote to memory of 2284 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 33 PID 2372 wrote to memory of 2284 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 33 PID 2372 wrote to memory of 2284 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 33 PID 2372 wrote to memory of 2284 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 33 PID 2372 wrote to memory of 1656 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 34 PID 2372 wrote to memory of 1656 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 34 PID 2372 wrote to memory of 1656 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 34 PID 2372 wrote to memory of 1656 2372 NEAS.2464e544067dcd3a8d6874cce174b020.exe 34 PID 2920 wrote to memory of 772 2920 backup.exe 35 PID 2920 wrote to memory of 772 2920 backup.exe 35 PID 2920 wrote to memory of 772 2920 backup.exe 35 PID 2920 wrote to memory of 772 2920 backup.exe 35 PID 772 wrote to memory of 584 772 backup.exe 36 PID 772 wrote to memory of 584 772 backup.exe 36 PID 772 wrote to memory of 584 772 backup.exe 36 PID 772 wrote to memory of 584 772 backup.exe 36 PID 584 wrote to memory of 1752 584 data.exe 37 PID 584 wrote to memory of 1752 584 data.exe 37 PID 584 wrote to memory of 1752 584 data.exe 37 PID 584 wrote to memory of 1752 584 data.exe 37 PID 772 wrote to memory of 2152 772 backup.exe 38 PID 772 wrote to memory of 2152 772 backup.exe 38 PID 772 wrote to memory of 2152 772 backup.exe 38 PID 772 wrote to memory of 2152 772 backup.exe 38 PID 2152 wrote to memory of 2148 2152 backup.exe 39 PID 2152 wrote to memory of 2148 2152 backup.exe 39 PID 2152 wrote to memory of 2148 2152 backup.exe 39 PID 2152 wrote to memory of 2148 2152 backup.exe 39 PID 2148 wrote to memory of 1056 2148 backup.exe 40 PID 2148 wrote to memory of 1056 2148 backup.exe 40 PID 2148 wrote to memory of 1056 2148 backup.exe 40 PID 2148 wrote to memory of 1056 2148 backup.exe 40 PID 2152 wrote to memory of 952 2152 backup.exe 41 PID 2152 wrote to memory of 952 2152 backup.exe 41 PID 2152 wrote to memory of 952 2152 backup.exe 41 PID 2152 wrote to memory of 952 2152 backup.exe 41 PID 952 wrote to memory of 2308 952 backup.exe 42 PID 952 wrote to memory of 2308 952 backup.exe 42 PID 952 wrote to memory of 2308 952 backup.exe 42 PID 952 wrote to memory of 2308 952 backup.exe 42 PID 952 wrote to memory of 2308 952 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2464e544067dcd3a8d6874cce174b020.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2464e544067dcd3a8d6874cce174b020.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3315675683\backup.exeC:\Users\Admin\AppData\Local\Temp\3315675683\backup.exe C:\Users\Admin\AppData\Local\Temp\3315675683\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2920 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\PerfLogs\data.exeC:\PerfLogs\data.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2148 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1056
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:952 -
C:\Program Files\Common Files\Microsoft Shared\update.exe"C:\Program Files\Common Files\Microsoft Shared\update.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2308 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2336 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1808
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2404
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2452
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2096
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2264
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2644
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2476
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:864
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2292
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2184
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2164
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2088
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2312
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2244
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2144
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3024 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2496
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:2564
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
PID:2956
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1676
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:852
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1520
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
PID:1068 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:2056
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:2196
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1948 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:2448
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:2868
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1808
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- System policy modification
PID:1612
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2088 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:2116
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:2932
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\data.exe"C:\Program Files\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:2540
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1844
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Drops file in Program Files directory
PID:1720 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:1396
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:2740
-
-
C:\Program Files\Common Files\SpeechEngines\data.exe"C:\Program Files\Common Files\SpeechEngines\data.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
PID:2104 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1592
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1672 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
PID:1168 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:2648
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1108
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
PID:1260
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1584
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2452
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:2536
-
-
-
C:\Program Files\Common Files\System\de-DE\update.exe"C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:2924
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:2948
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:2124
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2028
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2464
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2776
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2596
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:960
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1988 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2128
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:336
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1436
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:2940
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:2728
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1064
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:2964
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:2244
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:2764
-
-
-
C:\Program Files\Internet Explorer\update.exe"C:\Program Files\Internet Explorer\update.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2532 -
C:\Program Files\Internet Explorer\de-DE\data.exe"C:\Program Files\Internet Explorer\de-DE\data.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1032
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:848
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:784
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:2500
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:592
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2592
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵PID:1592
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵PID:2812
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:2792
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1704 -
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵PID:836
-
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵PID:2084
-
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\6⤵PID:2412
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1284
-
C:\Program Files\Microsoft Office\Office14\backup.exe"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\6⤵PID:2372
-
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2860
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2576
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:1952
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2428
-
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\5⤵PID:2140
-
-
C:\Program Files\Windows Journal\backup.exe"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\5⤵PID:1512
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1968 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1688 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
- System policy modification
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- System policy modification
PID:2116
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1760 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2672
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- System policy modification
PID:564
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:768
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:876
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:2288
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1832 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:2816
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1812
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1392
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:2712
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:2828
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:2628
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
PID:964 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:956
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
PID:2040 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:2768
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:2476
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2600
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2360
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2996
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:3060
-
-
-
C:\Program Files (x86)\Google\update.exe"C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2336 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:2908
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1692
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:920
-
-
-
C:\Program Files (x86)\Internet Explorer\data.exe"C:\Program Files (x86)\Internet Explorer\data.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:576
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:1752
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:528
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\5⤵PID:616
-
-
C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\5⤵PID:928
-
-
C:\Program Files (x86)\MSBuild\backup.exe"C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\5⤵PID:1008
-
-
-
C:\Users\System Restore.exe"C:\Users\System Restore.exe" C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1468 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1820
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:3028
-
-
-
C:\Windows\update.exeC:\Windows\update.exe C:\Windows\4⤵PID:2356
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5fe42159d9863fff0d627a7e3c8f37cba
SHA1f86ee3e7c187fd9b9f9c1c396635d8029307ceae
SHA256a227c0688e18f8026997dd5f1d936cf2bc76eb1603683232eedd0ebf5c1511cf
SHA512af408efee47f257424f7c75345e2c4f04518ed481b445b952a5deff3df0eed680cb59708e4a54957dd86a2517281f49f646b0cfb1c864ea0f506c5754927d9e4
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5a1005b58f7ff1d1592f3ffb4cc1a7eba
SHA1cdc2ccbeaf144672a4c5196dd1e3ad961de4f868
SHA256ecbea77a7998f45657b2938cf99882cc8b71009ba65ed10d7864cdd6775ab61e
SHA512c7d25a7b8c15fa7cccfee8a5818994560fbac6122ad1057c72721dea359c8177d3142fc7f98413548b2235a1068142b7da91f3fab150e880858f1a8710bd0002
-
Filesize
84KB
MD5a1005b58f7ff1d1592f3ffb4cc1a7eba
SHA1cdc2ccbeaf144672a4c5196dd1e3ad961de4f868
SHA256ecbea77a7998f45657b2938cf99882cc8b71009ba65ed10d7864cdd6775ab61e
SHA512c7d25a7b8c15fa7cccfee8a5818994560fbac6122ad1057c72721dea359c8177d3142fc7f98413548b2235a1068142b7da91f3fab150e880858f1a8710bd0002
-
Filesize
84KB
MD5bf03743d2cb6fdd8c4e7c9435e48bbf6
SHA1e30e4aad25f046a5a9737464ca5aef396fb415b0
SHA256ed91a8b51b739987e3c17533e1c006b36f9a09e5ad9430ed0349a702fa87b1bb
SHA5122f5244442f7dc68bbe42403485f6c5380f098b084763d981656998a769fdcdb3c8b0621e1b04915c4b1f14a02a778f94ddcc52183dc0a5644639590f3b4ea1f1
-
Filesize
84KB
MD5bf03743d2cb6fdd8c4e7c9435e48bbf6
SHA1e30e4aad25f046a5a9737464ca5aef396fb415b0
SHA256ed91a8b51b739987e3c17533e1c006b36f9a09e5ad9430ed0349a702fa87b1bb
SHA5122f5244442f7dc68bbe42403485f6c5380f098b084763d981656998a769fdcdb3c8b0621e1b04915c4b1f14a02a778f94ddcc52183dc0a5644639590f3b4ea1f1
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5327564163b38e0c0ed7df6c631d87043
SHA16aa987b70f1ce4e5e91989f28db08b8e2777d84b
SHA256b0aed004bcc6b93e69e5efe417aaaee375cc1702badc8766d70dbfd8634a8078
SHA512f2b0055e39ce7730ec6cddec21c5a314b3c497786f5d520010ad300b2e216dca29f5f058d94c67380f43dac7908a0de1c77bd385f0bd3f5e68c1c7fdf28b5c1e
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
30KB
MD59f727dc901039cd8c9d39d131ea60fb1
SHA190da506102e6596f85e807d1dd98d23a157fde41
SHA256bc7a1c18bf61175c643eee2cbc49a3af3021b31cd8dd459d8ecb53e9f4a96b48
SHA512f694dd676c07b09b9e60ffb71a345fb63bda00ba3f7a347e3b7075d0d68b31765b370277d8fd4cd4018e91ada0b89e93204d136fcac6fc2c67ecc15a534b7726
-
Filesize
84KB
MD572e1e14095d15448ef448f7cb616d33d
SHA1257fe535bdee407036beb2d6b18cc8412eb89bea
SHA256c8e572f2983f211c1bafbe0191ba648821be48dc30894952e2373a531f6ea258
SHA5128c3e4547e28a462668b6b298cc6dc524fdb8a0abf15186c2aaa5ff1775587cb55689a112978e3f728dec566d890a68ce83a4e43c95f70a702e176d9a0b201c86
-
Filesize
84KB
MD572e1e14095d15448ef448f7cb616d33d
SHA1257fe535bdee407036beb2d6b18cc8412eb89bea
SHA256c8e572f2983f211c1bafbe0191ba648821be48dc30894952e2373a531f6ea258
SHA5128c3e4547e28a462668b6b298cc6dc524fdb8a0abf15186c2aaa5ff1775587cb55689a112978e3f728dec566d890a68ce83a4e43c95f70a702e176d9a0b201c86
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5fe42159d9863fff0d627a7e3c8f37cba
SHA1f86ee3e7c187fd9b9f9c1c396635d8029307ceae
SHA256a227c0688e18f8026997dd5f1d936cf2bc76eb1603683232eedd0ebf5c1511cf
SHA512af408efee47f257424f7c75345e2c4f04518ed481b445b952a5deff3df0eed680cb59708e4a54957dd86a2517281f49f646b0cfb1c864ea0f506c5754927d9e4
-
Filesize
84KB
MD5fe42159d9863fff0d627a7e3c8f37cba
SHA1f86ee3e7c187fd9b9f9c1c396635d8029307ceae
SHA256a227c0688e18f8026997dd5f1d936cf2bc76eb1603683232eedd0ebf5c1511cf
SHA512af408efee47f257424f7c75345e2c4f04518ed481b445b952a5deff3df0eed680cb59708e4a54957dd86a2517281f49f646b0cfb1c864ea0f506c5754927d9e4
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD572ca9ef06cc579b4b3d293b58620935b
SHA1cba4009a37d1cd8c7c17694bb609dbb43e22f7f7
SHA256d304633d55875d2c5446190413b91b0ef49cdba588cc23143c5a3c6f9c76261b
SHA5120ce3009b47466f0d7cd8ff2afaf1f11c00fbb665ba7961a864f0bff861681ac6fbf2bc6ade2c27e56baba77270e73b044263aa83bae22162483a41e9fc078399
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5b635021d5eb30578c077aa97268bbf8a
SHA11b5c279291776ce30fa55903ec867253eb71bc4f
SHA25692c17a0a36f88fb0c19e6320ce4a65de1f54e3ebaee3eb5075fc721f46c9810d
SHA51256a15c3243f3c24df1e399530d757dec99da6040e2bfc0eeab107bdb473899bbf7d90209d3cd5c77223d3c4140394a14621543581b285a580f9f2ac82cb8c5f8
-
Filesize
84KB
MD5a1005b58f7ff1d1592f3ffb4cc1a7eba
SHA1cdc2ccbeaf144672a4c5196dd1e3ad961de4f868
SHA256ecbea77a7998f45657b2938cf99882cc8b71009ba65ed10d7864cdd6775ab61e
SHA512c7d25a7b8c15fa7cccfee8a5818994560fbac6122ad1057c72721dea359c8177d3142fc7f98413548b2235a1068142b7da91f3fab150e880858f1a8710bd0002
-
Filesize
84KB
MD5a1005b58f7ff1d1592f3ffb4cc1a7eba
SHA1cdc2ccbeaf144672a4c5196dd1e3ad961de4f868
SHA256ecbea77a7998f45657b2938cf99882cc8b71009ba65ed10d7864cdd6775ab61e
SHA512c7d25a7b8c15fa7cccfee8a5818994560fbac6122ad1057c72721dea359c8177d3142fc7f98413548b2235a1068142b7da91f3fab150e880858f1a8710bd0002
-
Filesize
84KB
MD5a1005b58f7ff1d1592f3ffb4cc1a7eba
SHA1cdc2ccbeaf144672a4c5196dd1e3ad961de4f868
SHA256ecbea77a7998f45657b2938cf99882cc8b71009ba65ed10d7864cdd6775ab61e
SHA512c7d25a7b8c15fa7cccfee8a5818994560fbac6122ad1057c72721dea359c8177d3142fc7f98413548b2235a1068142b7da91f3fab150e880858f1a8710bd0002
-
Filesize
84KB
MD5a1005b58f7ff1d1592f3ffb4cc1a7eba
SHA1cdc2ccbeaf144672a4c5196dd1e3ad961de4f868
SHA256ecbea77a7998f45657b2938cf99882cc8b71009ba65ed10d7864cdd6775ab61e
SHA512c7d25a7b8c15fa7cccfee8a5818994560fbac6122ad1057c72721dea359c8177d3142fc7f98413548b2235a1068142b7da91f3fab150e880858f1a8710bd0002
-
Filesize
84KB
MD5bf03743d2cb6fdd8c4e7c9435e48bbf6
SHA1e30e4aad25f046a5a9737464ca5aef396fb415b0
SHA256ed91a8b51b739987e3c17533e1c006b36f9a09e5ad9430ed0349a702fa87b1bb
SHA5122f5244442f7dc68bbe42403485f6c5380f098b084763d981656998a769fdcdb3c8b0621e1b04915c4b1f14a02a778f94ddcc52183dc0a5644639590f3b4ea1f1
-
Filesize
84KB
MD5bf03743d2cb6fdd8c4e7c9435e48bbf6
SHA1e30e4aad25f046a5a9737464ca5aef396fb415b0
SHA256ed91a8b51b739987e3c17533e1c006b36f9a09e5ad9430ed0349a702fa87b1bb
SHA5122f5244442f7dc68bbe42403485f6c5380f098b084763d981656998a769fdcdb3c8b0621e1b04915c4b1f14a02a778f94ddcc52183dc0a5644639590f3b4ea1f1
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5b63af335036982cd64d99accfb65fcf4
SHA101b0e86bfa71f7768cf9477994ab2855ad2a24bd
SHA2569b72bb3a6242cb71d81b1f11e853dd982bd999cdfe963cadaf13966bf6687d63
SHA512b5910f3b6619e6632845f548c931e551cb5645321eaad7cef45484ab0757e71de406bc2ea043eba336c253d9df6521fadb1e98234c336642df270e4821fde13d
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5327564163b38e0c0ed7df6c631d87043
SHA16aa987b70f1ce4e5e91989f28db08b8e2777d84b
SHA256b0aed004bcc6b93e69e5efe417aaaee375cc1702badc8766d70dbfd8634a8078
SHA512f2b0055e39ce7730ec6cddec21c5a314b3c497786f5d520010ad300b2e216dca29f5f058d94c67380f43dac7908a0de1c77bd385f0bd3f5e68c1c7fdf28b5c1e
-
Filesize
84KB
MD5327564163b38e0c0ed7df6c631d87043
SHA16aa987b70f1ce4e5e91989f28db08b8e2777d84b
SHA256b0aed004bcc6b93e69e5efe417aaaee375cc1702badc8766d70dbfd8634a8078
SHA512f2b0055e39ce7730ec6cddec21c5a314b3c497786f5d520010ad300b2e216dca29f5f058d94c67380f43dac7908a0de1c77bd385f0bd3f5e68c1c7fdf28b5c1e
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2
-
Filesize
84KB
MD5b30c7deee6ad7809596cd2bf1bed762d
SHA16ab56a7971c2ca25de06dd513ab98aee3dabd227
SHA25696e29802feeecbfc2c04ef2cecad9832f594ef1adf753cbebe61dc91eb6fd635
SHA51238c7bfd6dfa51faf8a581dfdf250920c4f83e1dccea8363e0f54bf0ffa0407c171ed8ec927b5b4636a8566197a56964fb5660a2a59694cda812a7511edeaa1d2