Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:27
Behavioral task
behavioral1
Sample
NEAS.a032449643dc4f5d56aa50f8349400b0.exe
Resource
win7-20230831-en
General
-
Target
NEAS.a032449643dc4f5d56aa50f8349400b0.exe
-
Size
84KB
-
MD5
a032449643dc4f5d56aa50f8349400b0
-
SHA1
673acf984fe43f397dc9dd90f2e50db3bf25170a
-
SHA256
1056ba7e437644ad7f5eafe06410608c140111d61a78977129aeba4db917f384
-
SHA512
d3e9311f44c1ad8db7e827c8008777a23959e3fe227687f0b88a0adc12623556a48e8c2fbc587529c82c948f5712d39736e6c182c075d736513ec98464796dd6
-
SSDEEP
768:/pQNwC3BESe4Vqth+0V5vKmyLylze70wi3BEmB:BeT7BVwxfvEFwjRB
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 3480 data.exe 3992 backup.exe 3476 backup.exe 4028 backup.exe 3884 backup.exe 2824 backup.exe 4732 backup.exe 4868 backup.exe 392 backup.exe 4712 backup.exe 388 backup.exe 1436 backup.exe 4936 backup.exe 640 backup.exe 2296 backup.exe 2700 backup.exe 4988 backup.exe 628 backup.exe 4820 backup.exe 1716 backup.exe 796 backup.exe 4284 backup.exe 3216 backup.exe 4212 backup.exe 4304 backup.exe 4176 backup.exe 3500 backup.exe 3672 backup.exe 3152 backup.exe 3992 backup.exe 2768 backup.exe 4152 backup.exe 2212 backup.exe 4060 backup.exe 3848 backup.exe 944 backup.exe 5056 backup.exe 1240 backup.exe 1352 backup.exe 752 backup.exe 3808 backup.exe 412 backup.exe 3384 System Restore.exe 3096 backup.exe 3920 backup.exe 1728 backup.exe 2808 backup.exe 4548 backup.exe 5064 backup.exe 4480 backup.exe 4184 backup.exe 4032 backup.exe 3860 backup.exe 2732 backup.exe 1112 backup.exe 3444 backup.exe 3900 backup.exe 4320 backup.exe 3216 backup.exe 1596 backup.exe 4148 backup.exe 1048 backup.exe 3500 backup.exe 2696 backup.exe -
resource yara_rule behavioral2/memory/4208-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0006000000022def-6.dat upx behavioral2/files/0x0006000000022def-7.dat upx behavioral2/files/0x0006000000022df2-11.dat upx behavioral2/files/0x0006000000022df2-12.dat upx behavioral2/files/0x0006000000022df2-13.dat upx behavioral2/memory/3992-14-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022df9-20.dat upx behavioral2/memory/3992-18-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022df9-21.dat upx behavioral2/files/0x0006000000022dfa-26.dat upx behavioral2/files/0x0006000000022dfa-27.dat upx behavioral2/memory/4028-31-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022dfb-33.dat upx behavioral2/files/0x0007000000022dfb-34.dat upx behavioral2/files/0x0006000000022dfc-39.dat upx behavioral2/files/0x0006000000022dfc-40.dat upx behavioral2/memory/2824-44-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022dfd-46.dat upx behavioral2/files/0x0007000000022dfd-47.dat upx behavioral2/memory/4732-51-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022dfe-55.dat upx behavioral2/files/0x0007000000022dfe-53.dat upx behavioral2/files/0x0006000000022dff-58.dat upx behavioral2/memory/4208-59-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0006000000022dff-57.dat upx behavioral2/memory/4868-69-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e00-67.dat upx behavioral2/files/0x0007000000022e00-68.dat upx behavioral2/memory/3480-72-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0006000000022e02-71.dat upx behavioral2/files/0x0006000000022e02-75.dat upx behavioral2/files/0x0006000000022e05-81.dat upx behavioral2/memory/388-83-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e04-85.dat upx behavioral2/memory/3476-87-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0006000000022e05-82.dat upx behavioral2/files/0x0007000000022e04-88.dat upx behavioral2/files/0x0003000000022e07-94.dat upx behavioral2/files/0x0003000000022e07-95.dat upx behavioral2/files/0x0007000000022e08-100.dat upx behavioral2/memory/3884-101-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e08-99.dat upx behavioral2/memory/4936-98-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/640-106-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1436-107-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4712-108-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e09-111.dat upx behavioral2/memory/392-112-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e09-113.dat upx behavioral2/memory/3884-116-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0006000000022e12-120.dat upx behavioral2/files/0x0006000000022e12-121.dat upx behavioral2/memory/4988-126-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000a000000022e03-128.dat upx behavioral2/memory/2700-125-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000a000000022e03-129.dat upx behavioral2/memory/3476-132-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2296-137-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0007000000022e11-141.dat upx behavioral2/files/0x0007000000022e13-138.dat upx behavioral2/files/0x0007000000022e13-136.dat upx behavioral2/files/0x0007000000022e11-140.dat upx behavioral2/memory/4820-150-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft.NET\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\Office16\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files\ModifiableWindowsApps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe backup.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe backup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\apppatch\Custom\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\Extensibility\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\apppatch\ja-JP\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe backup.exe File opened for modification C:\Windows\apppatch\es-ES\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\Branding\Basebrd\fr-FR\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\mscomctl\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\appcompat\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe backup.exe File opened for modification C:\Windows\apppatch\en-US\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\backup.exe backup.exe File opened for modification C:\Windows\bcastdvr\backup.exe backup.exe File opened for modification C:\Windows\appcompat\Programs\backup.exe backup.exe File opened for modification C:\Windows\apppatch\CustomSDB\backup.exe backup.exe File opened for modification C:\Windows\apppatch\it-IT\update.exe backup.exe File opened for modification C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe backup.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\data.exe backup.exe File opened for modification C:\Windows\Branding\shellbrd\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\backup.exe backup.exe File opened for modification C:\Windows\Branding\Basebrd\es-ES\backup.exe backup.exe File opened for modification C:\Windows\Cursors\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\ADODB\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_MSIL\backup.exe backup.exe File opened for modification C:\Windows\Branding\Basebrd\de-DE\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe backup.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe backup.exe File opened for modification C:\Windows\apppatch\de-DE\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe data.exe File opened for modification C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\MSDATASRC\backup.exe backup.exe File opened for modification C:\Windows\AppReadiness\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe File opened for modification C:\Windows\apppatch\backup.exe backup.exe File opened for modification C:\Windows\apppatch\AppPatch64\System Restore.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\System Restore.exe backup.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\stdole\backup.exe backup.exe File opened for modification C:\Windows\appcompat\encapsulation\System Restore.exe backup.exe File opened for modification C:\Windows\apppatch\fr-FR\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\data.exe backup.exe File opened for modification C:\Windows\Containers\serviced\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 3480 data.exe 3992 backup.exe 3476 backup.exe 4028 backup.exe 3884 backup.exe 2824 backup.exe 4732 backup.exe 4868 backup.exe 392 backup.exe 4712 backup.exe 388 backup.exe 1436 backup.exe 4936 backup.exe 640 backup.exe 2296 backup.exe 2700 backup.exe 4988 backup.exe 628 backup.exe 1716 backup.exe 4820 backup.exe 796 backup.exe 4284 backup.exe 4212 backup.exe 3216 backup.exe 4304 backup.exe 3500 backup.exe 4176 backup.exe 3672 backup.exe 3992 backup.exe 3152 backup.exe 2768 backup.exe 4152 backup.exe 2212 backup.exe 4060 backup.exe 3848 backup.exe 944 backup.exe 5056 backup.exe 1240 backup.exe 1352 backup.exe 752 backup.exe 3808 backup.exe 412 backup.exe 3384 System Restore.exe 3096 backup.exe 3920 backup.exe 1728 backup.exe 4480 backup.exe 2808 backup.exe 4548 backup.exe 3860 backup.exe 5064 backup.exe 4184 backup.exe 4032 backup.exe 2732 backup.exe 1112 backup.exe 3444 backup.exe 1596 backup.exe 4148 backup.exe 3216 backup.exe 3900 backup.exe 4320 backup.exe 1048 backup.exe 3500 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4208 wrote to memory of 3480 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 87 PID 4208 wrote to memory of 3480 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 87 PID 4208 wrote to memory of 3480 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 87 PID 4208 wrote to memory of 3992 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 89 PID 4208 wrote to memory of 3992 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 89 PID 4208 wrote to memory of 3992 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 89 PID 4208 wrote to memory of 3476 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 90 PID 4208 wrote to memory of 3476 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 90 PID 4208 wrote to memory of 3476 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 90 PID 4208 wrote to memory of 4028 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 91 PID 4208 wrote to memory of 4028 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 91 PID 4208 wrote to memory of 4028 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 91 PID 4208 wrote to memory of 3884 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 92 PID 4208 wrote to memory of 3884 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 92 PID 4208 wrote to memory of 3884 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 92 PID 4208 wrote to memory of 2824 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 93 PID 4208 wrote to memory of 2824 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 93 PID 4208 wrote to memory of 2824 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 93 PID 4208 wrote to memory of 4732 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 94 PID 4208 wrote to memory of 4732 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 94 PID 4208 wrote to memory of 4732 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 94 PID 4208 wrote to memory of 4868 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 95 PID 4208 wrote to memory of 4868 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 95 PID 4208 wrote to memory of 4868 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 95 PID 3480 wrote to memory of 392 3480 data.exe 96 PID 3480 wrote to memory of 392 3480 data.exe 96 PID 3480 wrote to memory of 392 3480 data.exe 96 PID 4208 wrote to memory of 4712 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 97 PID 4208 wrote to memory of 4712 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 97 PID 4208 wrote to memory of 4712 4208 NEAS.a032449643dc4f5d56aa50f8349400b0.exe 97 PID 392 wrote to memory of 388 392 backup.exe 98 PID 392 wrote to memory of 388 392 backup.exe 98 PID 392 wrote to memory of 388 392 backup.exe 98 PID 4712 wrote to memory of 1436 4712 backup.exe 99 PID 4712 wrote to memory of 1436 4712 backup.exe 99 PID 4712 wrote to memory of 1436 4712 backup.exe 99 PID 392 wrote to memory of 4936 392 backup.exe 100 PID 392 wrote to memory of 4936 392 backup.exe 100 PID 392 wrote to memory of 4936 392 backup.exe 100 PID 1436 wrote to memory of 640 1436 backup.exe 101 PID 1436 wrote to memory of 640 1436 backup.exe 101 PID 1436 wrote to memory of 640 1436 backup.exe 101 PID 392 wrote to memory of 2296 392 backup.exe 102 PID 392 wrote to memory of 2296 392 backup.exe 102 PID 392 wrote to memory of 2296 392 backup.exe 102 PID 2296 wrote to memory of 2700 2296 backup.exe 103 PID 2296 wrote to memory of 2700 2296 backup.exe 103 PID 2296 wrote to memory of 2700 2296 backup.exe 103 PID 2700 wrote to memory of 4988 2700 backup.exe 104 PID 2700 wrote to memory of 4988 2700 backup.exe 104 PID 2700 wrote to memory of 4988 2700 backup.exe 104 PID 2296 wrote to memory of 628 2296 backup.exe 105 PID 2296 wrote to memory of 628 2296 backup.exe 105 PID 2296 wrote to memory of 628 2296 backup.exe 105 PID 628 wrote to memory of 4820 628 backup.exe 108 PID 628 wrote to memory of 4820 628 backup.exe 108 PID 628 wrote to memory of 4820 628 backup.exe 108 PID 392 wrote to memory of 1716 392 backup.exe 107 PID 392 wrote to memory of 1716 392 backup.exe 107 PID 392 wrote to memory of 1716 392 backup.exe 107 PID 628 wrote to memory of 796 628 backup.exe 110 PID 628 wrote to memory of 796 628 backup.exe 110 PID 628 wrote to memory of 796 628 backup.exe 110 PID 1716 wrote to memory of 4284 1716 backup.exe 109 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" NEAS.a032449643dc4f5d56aa50f8349400b0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a032449643dc4f5d56aa50f8349400b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a032449643dc4f5d56aa50f8349400b0.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\{670618DA-38FA-4D6D-9BA5-0E8C76874498}\data.exeC:\Users\Admin\AppData\Local\Temp\{670618DA-38FA-4D6D-9BA5-0E8C76874498}\data.exe C:\Users\Admin\AppData\Local\Temp\{670618DA-38FA-4D6D-9BA5-0E8C76874498}\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:388
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4936
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4820
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:796 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3216
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4176 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3096
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1596
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵PID:4972
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵PID:640
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4548
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:4060
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵PID:1048
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Modifies visibility of file extensions in Explorer
PID:2396
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵PID:5088
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵PID:2636
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵PID:1436
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵PID:1468
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Drops file in Program Files directory
PID:1964 -
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵PID:768
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵PID:1744
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵PID:4028
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵PID:1836
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵
- System policy modification
PID:1840
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵PID:4028
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵PID:1540
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵
- System policy modification
PID:4972
-
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵PID:4876
-
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵PID:2528
-
-
C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\8⤵PID:4608
-
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵PID:1940
-
-
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\8⤵PID:384
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1240 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵PID:4548
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3900
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵PID:3048
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵PID:3980
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵PID:4144
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:3200
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4480 -
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3500
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵PID:832
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4184
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
PID:3764 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵PID:4288
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1760 -
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:2864
-
-
-
C:\Program Files\Common Files\microsoft shared\VC\System Restore.exe"C:\Program Files\Common Files\microsoft shared\VC\System Restore.exe" C:\Program Files\Common Files\microsoft shared\VC\7⤵PID:5088
-
-
C:\Program Files\Common Files\microsoft shared\VGX\backup.exe"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\7⤵
- Modifies visibility of file extensions in Explorer
PID:1596
-
-
C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\7⤵PID:4676
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\8⤵
- Drops file in Program Files directory
PID:2756 -
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\9⤵PID:1704
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3992
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5056 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1728 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1112
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Executes dropped EXE
PID:2696
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:3644
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2732
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:3016
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:3284
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:4312
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:4052
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1192
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
PID:4672
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:5040
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1600
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:3052
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:1152
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵PID:3152
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵PID:2200
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:3432
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵PID:4876
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:4868
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:4712
-
C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:4492
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:4532
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵PID:4756
-
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵PID:4452
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4304 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3152 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:944 -
C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:752 -
C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\9⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\9⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\9⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\9⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\9⤵
- System policy modification
PID:4292
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\9⤵
- System policy modification
PID:4288
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:448
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4152 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:412
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5064
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- System policy modification
PID:3992
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3216
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:5096
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2144
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵PID:932
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵PID:1972
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:3140
-
C:\Program Files\Java\jdk-1.8\backup.exe"C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\6⤵PID:3644
-
C:\Program Files\Java\jdk-1.8\bin\backup.exe"C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\7⤵PID:4460
-
-
C:\Program Files\Java\jdk-1.8\include\backup.exe"C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\7⤵
- Drops file in Program Files directory
PID:2404 -
C:\Program Files\Java\jdk-1.8\include\win32\backup.exe"C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\8⤵
- Drops file in Program Files directory
PID:1428 -
C:\Program Files\Java\jdk-1.8\include\win32\bridge\System Restore.exe"C:\Program Files\Java\jdk-1.8\include\win32\bridge\System Restore.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\9⤵PID:4572
-
-
-
-
C:\Program Files\Java\jdk-1.8\jre\backup.exe"C:\Program Files\Java\jdk-1.8\jre\backup.exe" C:\Program Files\Java\jdk-1.8\jre\7⤵
- System policy modification
PID:4528 -
C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe"C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\8⤵
- Drops file in Program Files directory
PID:3392 -
C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe"C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\9⤵
- System policy modification
PID:4544
-
-
C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe"C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\9⤵PID:4696
-
-
C:\Program Files\Java\jdk-1.8\jre\bin\server\update.exe"C:\Program Files\Java\jdk-1.8\jre\bin\server\update.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\9⤵PID:2176
-
-
-
C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe"C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\8⤵PID:3320
-
C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe"C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\9⤵PID:824
-
-
C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe"C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\9⤵
- System policy modification
PID:1764
-
-
-
C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe"C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\8⤵
- Drops file in Program Files directory
PID:4508 -
C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe"C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\9⤵PID:1744
-
-
C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe"C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\9⤵PID:4600
-
-
C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe"C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\9⤵PID:4884
-
-
C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe"C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\9⤵PID:3372
-
-
-
-
C:\Program Files\Java\jdk-1.8\legal\backup.exe"C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\7⤵
- Drops file in Program Files directory
PID:2680 -
C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe"C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\8⤵PID:2200
-
-
C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe"C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\8⤵PID:2784
-
-
-
C:\Program Files\Java\jdk-1.8\lib\backup.exe"C:\Program Files\Java\jdk-1.8\lib\backup.exe" C:\Program Files\Java\jdk-1.8\lib\7⤵
- System policy modification
PID:3520
-
-
-
C:\Program Files\Java\jre-1.8\backup.exe"C:\Program Files\Java\jre-1.8\backup.exe" C:\Program Files\Java\jre-1.8\6⤵PID:3964
-
C:\Program Files\Java\jre-1.8\bin\data.exe"C:\Program Files\Java\jre-1.8\bin\data.exe" C:\Program Files\Java\jre-1.8\bin\7⤵
- Modifies visibility of file extensions in Explorer
PID:448 -
C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe"C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\8⤵PID:4580
-
-
C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe"C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\8⤵PID:3004
-
-
C:\Program Files\Java\jre-1.8\bin\server\backup.exe"C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\8⤵PID:3220
-
-
-
C:\Program Files\Java\jre-1.8\legal\backup.exe"C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\7⤵
- Modifies visibility of file extensions in Explorer
PID:4580 -
C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe"C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\8⤵PID:2336
-
-
C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe"C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\8⤵
- System policy modification
PID:740
-
-
-
C:\Program Files\Java\jre-1.8\lib\backup.exe"C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\7⤵PID:1484
-
C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe"C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\8⤵PID:3068
-
-
C:\Program Files\Java\jre-1.8\lib\applet\System Restore.exe"C:\Program Files\Java\jre-1.8\lib\applet\System Restore.exe" C:\Program Files\Java\jre-1.8\lib\applet\8⤵PID:224
-
-
C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe"C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\8⤵PID:5124
-
-
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Drops file in Program Files directory
PID:3960 -
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵
- Modifies visibility of file extensions in Explorer
PID:1784
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3556
-
-
C:\Program Files\Microsoft Office\root\backup.exe"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\6⤵
- Drops file in Program Files directory
PID:2152 -
C:\Program Files\Microsoft Office\root\Client\backup.exe"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\7⤵PID:3712
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2636 -
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\update.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\update.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\8⤵PID:1244
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\8⤵PID:1464
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\8⤵PID:3120
-
-
-
C:\Program Files\Microsoft Office\root\fre\backup.exe"C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\7⤵PID:3164
-
-
-
C:\Program Files\Microsoft Office\Updates\backup.exe"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\6⤵
- Modifies visibility of file extensions in Explorer
PID:1296 -
C:\Program Files\Microsoft Office\Updates\Apply\backup.exe"C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\7⤵
- System policy modification
PID:4032 -
C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\8⤵
- Modifies visibility of file extensions in Explorer
PID:1428 -
C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\06E77004-A6CB-4B7D-B3A6-BE67BAE8CE55\backup.exe"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\06E77004-A6CB-4B7D-B3A6-BE67BAE8CE55\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\06E77004-A6CB-4B7D-B3A6-BE67BAE8CE55\9⤵
- Modifies visibility of file extensions in Explorer
PID:2200
-
-
-
-
C:\Program Files\Microsoft Office\Updates\Download\backup.exe"C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1492
-
-
-
-
C:\Program Files\Microsoft Office 15\System Restore.exe"C:\Program Files\Microsoft Office 15\System Restore.exe" C:\Program Files\Microsoft Office 15\5⤵
- System policy modification
PID:4756 -
C:\Program Files\Microsoft Office 15\ClientX64\backup.exe"C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\6⤵
- System policy modification
PID:3556
-
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
- Drops file in Program Files directory
- System policy modification
PID:2712 -
C:\Program Files\Mozilla Firefox\browser\backup.exe"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\6⤵PID:4992
-
C:\Program Files\Mozilla Firefox\browser\features\data.exe"C:\Program Files\Mozilla Firefox\browser\features\data.exe" C:\Program Files\Mozilla Firefox\browser\features\7⤵PID:1644
-
-
C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe"C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\7⤵PID:3100
-
-
-
C:\Program Files\Mozilla Firefox\defaults\backup.exe"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\6⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\fonts\data.exe"C:\Program Files\Mozilla Firefox\fonts\data.exe" C:\Program Files\Mozilla Firefox\fonts\6⤵PID:3284
-
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:3808
-
C:\Program Files\MSBuild\Microsoft\backup.exe"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\6⤵
- Drops file in Program Files directory
PID:5080 -
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\7⤵PID:4024
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\8⤵PID:1928
-
-
-
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2260
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4284 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4212 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3500
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2768 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3920 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4032
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵PID:832
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4148
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1644
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- System policy modification
PID:4332 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵PID:2268
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Drops file in Program Files directory
PID:3148 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\9⤵PID:4736
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵PID:4488
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
PID:3576 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1016
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\8⤵PID:8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\9⤵PID:4368
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\8⤵
- System policy modification
PID:968 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\9⤵PID:3216
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\10⤵PID:4320
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\9⤵PID:3324
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\10⤵PID:2348
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:4600
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\9⤵PID:2156
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\8⤵
- System policy modification
PID:2780 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\9⤵PID:3548
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\8⤵PID:1404
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\8⤵
- Modifies visibility of file extensions in Explorer
PID:3568
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\8⤵
- Drops file in Program Files directory
PID:1480 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\9⤵PID:2240
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Drops file in Program Files directory
PID:4980 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
PID:1592 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵PID:3556
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵PID:3764
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵PID:3220
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\9⤵PID:4720
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\10⤵PID:2664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\10⤵
- Drops file in Program Files directory
- System policy modification
PID:3536 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵PID:4708
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\11⤵PID:3600
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3320
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2212 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3808 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4184
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵PID:1048
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- Modifies visibility of file extensions in Explorer
PID:4912 -
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵
- System policy modification
PID:2104
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵PID:3492
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵
- Drops file in Program Files directory
PID:4024 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\9⤵PID:2412
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\10⤵PID:2860
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\10⤵PID:376
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\11⤵PID:3568
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\11⤵
- System policy modification
PID:1296 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\12⤵
- Drops file in Program Files directory
PID:540 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\13⤵PID:3344
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\14⤵
- Modifies visibility of file extensions in Explorer
PID:4088
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\14⤵PID:4732
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\14⤵
- Modifies visibility of file extensions in Explorer
PID:2984
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\13⤵PID:768
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\14⤵PID:4208
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\14⤵
- System policy modification
PID:4188
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\update.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\14⤵
- System policy modification
PID:3632
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\13⤵PID:1144
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\14⤵PID:4520
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\14⤵
- Modifies visibility of file extensions in Explorer
PID:3960
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\14⤵PID:4212
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2528 -
C:\Program Files (x86)\Common Files\Java\Java Update\System Restore.exe"C:\Program Files (x86)\Common Files\Java\Java Update\System Restore.exe" C:\Program Files (x86)\Common Files\Java\Java Update\7⤵PID:4620
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\6⤵
- Drops file in Program Files directory
PID:4736 -
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\7⤵
- System policy modification
PID:3872
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\7⤵PID:1476
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\7⤵
- Drops file in Program Files directory
PID:3200 -
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\8⤵PID:2348
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\8⤵PID:4088
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\8⤵PID:2700
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\8⤵PID:3600
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\7⤵
- Drops file in Program Files directory
PID:4460 -
C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\8⤵
- System policy modification
PID:5040
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:4148 -
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1188
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\System Restore.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\7⤵PID:1644
-
C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:5680
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
PID:4316
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\7⤵PID:2244
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\7⤵PID:3644
-
-
-
C:\Program Files (x86)\Common Files\Oracle\backup.exe"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\6⤵PID:4960
-
C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe"C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\7⤵
- Drops file in Program Files directory
PID:1260 -
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\8⤵PID:2788
-
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
PID:400
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
- Drops file in Program Files directory
- System policy modification
PID:2016 -
C:\Program Files (x86)\Common Files\System\ado\backup.exe"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\7⤵PID:3900
-
C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\8⤵PID:3184
-
-
C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\8⤵PID:4384
-
-
-
C:\Program Files (x86)\Common Files\System\de-DE\backup.exe"C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\7⤵PID:4688
-
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
PID:2680 -
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
- System policy modification
PID:3980
-
-
C:\Program Files (x86)\Google\CrashReports\data.exe"C:\Program Files (x86)\Google\CrashReports\data.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
PID:2888
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:3384
-
C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\7⤵
- Modifies visibility of file extensions in Explorer
PID:2984
-
-
C:\Program Files (x86)\Google\Update\Download\backup.exe"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732 -
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\update.exe"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\update.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\8⤵PID:2180
-
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\9⤵
- System policy modification
PID:4152
-
-
-
-
C:\Program Files (x86)\Google\Update\Install\backup.exe"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\7⤵PID:1840
-
C:\Program Files (x86)\Google\Update\Install\{2E401999-8512-4AB8-A131-FEF20E3CEB55}\backup.exe"C:\Program Files (x86)\Google\Update\Install\{2E401999-8512-4AB8-A131-FEF20E3CEB55}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{2E401999-8512-4AB8-A131-FEF20E3CEB55}\8⤵PID:3184
-
-
-
C:\Program Files (x86)\Google\Update\Offline\update.exe"C:\Program Files (x86)\Google\Update\Offline\update.exe" C:\Program Files (x86)\Google\Update\Offline\7⤵
- System policy modification
PID:3632
-
-
-
-
C:\Program Files (x86)\Internet Explorer\data.exe"C:\Program Files (x86)\Internet Explorer\data.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
PID:2892 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:2016
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:4416
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:2080
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:3872
-
-
C:\Program Files (x86)\Internet Explorer\images\backup.exe"C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\6⤵PID:3484
-
-
C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe"C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\6⤵PID:3632
-
-
C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\6⤵PID:4920
-
-
C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\6⤵
- Modifies visibility of file extensions in Explorer
PID:3092
-
-
-
C:\Program Files (x86)\Microsoft\backup.exe"C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\5⤵
- Modifies visibility of file extensions in Explorer
PID:368 -
C:\Program Files (x86)\Microsoft\Edge\backup.exe"C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\6⤵PID:3736
-
C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\7⤵
- Drops file in Program Files directory
PID:4760 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\8⤵
- Drops file in Program Files directory
PID:1360 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\9⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\9⤵PID:448
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8⤵PID:2984
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\6⤵
- Modifies visibility of file extensions in Explorer
PID:1476 -
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\backup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\7⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:3544 -
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\8⤵PID:3548
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\7⤵PID:3092
-
-
-
C:\Program Files (x86)\Microsoft\Temp\backup.exe"C:\Program Files (x86)\Microsoft\Temp\backup.exe" C:\Program Files (x86)\Microsoft\Temp\6⤵PID:4236
-
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:3048 -
C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe"C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\6⤵PID:392
-
-
-
C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1592 -
C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe"C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\6⤵PID:3044
-
-
-
C:\Program Files (x86)\MSBuild\backup.exe"C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\5⤵
- Drops file in Program Files directory
PID:2696 -
C:\Program Files (x86)\MSBuild\Microsoft\backup.exe"C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\6⤵PID:5952
-
-
-
C:\Program Files (x86)\Reference Assemblies\update.exe"C:\Program Files (x86)\Reference Assemblies\update.exe" C:\Program Files (x86)\Reference Assemblies\5⤵PID:3804
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3672 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3848 -
C:\Users\Admin\3D Objects\System Restore.exe"C:\Users\Admin\3D Objects\System Restore.exe" C:\Users\Admin\3D Objects\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3384
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:2732
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:3500
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- System policy modification
PID:2756 -
C:\Users\Admin\Documents\OneNote Notebooks\backup.exe"C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\7⤵PID:2528
-
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe"C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\8⤵PID:4488
-
-
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:5040
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:640
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2892
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:1548
-
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵PID:864
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3152 -
C:\Users\Admin\Pictures\Camera Roll\backup.exe"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\7⤵PID:1644
-
-
C:\Users\Admin\Pictures\Saved Pictures\backup.exe"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\7⤵PID:2680
-
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- System policy modification
PID:4756
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:1172
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵PID:1840
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:3928
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:4580
-
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- System policy modification
PID:4972
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:8
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:4084
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵PID:4312
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1352 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2808
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4320 -
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Drops file in Windows directory
PID:3432 -
C:\Windows\appcompat\appraiser\Telemetry\backup.exeC:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵PID:2080
-
-
-
C:\Windows\appcompat\encapsulation\System Restore.exe"C:\Windows\appcompat\encapsulation\System Restore.exe" C:\Windows\appcompat\encapsulation\6⤵PID:4460
-
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵
- System policy modification
PID:1164
-
-
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵
- Drops file in Windows directory
PID:3164 -
C:\Windows\apppatch\AppPatch64\System Restore.exe"C:\Windows\apppatch\AppPatch64\System Restore.exe" C:\Windows\apppatch\AppPatch64\6⤵
- Modifies visibility of file extensions in Explorer
PID:4304
-
-
C:\Windows\apppatch\Custom\backup.exeC:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:1480 -
C:\Windows\apppatch\Custom\Custom64\backup.exeC:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\7⤵PID:4744
-
-
-
C:\Windows\apppatch\CustomSDB\backup.exeC:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\6⤵
- Modifies visibility of file extensions in Explorer
PID:3528
-
-
C:\Windows\apppatch\de-DE\backup.exeC:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\6⤵
- System policy modification
PID:4284
-
-
C:\Windows\apppatch\en-US\backup.exeC:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\6⤵PID:4324
-
-
C:\Windows\apppatch\fr-FR\backup.exeC:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
PID:456
-
-
C:\Windows\apppatch\es-ES\backup.exeC:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
PID:2128
-
-
C:\Windows\apppatch\it-IT\update.exeC:\Windows\apppatch\it-IT\update.exe C:\Windows\apppatch\it-IT\6⤵PID:1304
-
-
C:\Windows\apppatch\ja-JP\backup.exeC:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\6⤵PID:1752
-
-
-
C:\Windows\AppReadiness\backup.exeC:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\5⤵PID:8
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵
- Drops file in Windows directory
- System policy modification
PID:1524 -
C:\Windows\assembly\GAC\backup.exeC:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\6⤵
- Drops file in Windows directory
- System policy modification
PID:760 -
C:\Windows\assembly\GAC\Extensibility\backup.exeC:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\7⤵
- Drops file in Windows directory
PID:4584 -
C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\8⤵PID:1360
-
-
-
C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exeC:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7⤵
- Drops file in Windows directory
PID:3576 -
C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\8⤵PID:3092
-
-
-
C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exeC:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:3580 -
C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\8⤵PID:3120
-
-
-
C:\Windows\assembly\GAC\mscomctl\backup.exeC:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\7⤵
- Drops file in Windows directory
PID:5056 -
C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exeC:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\8⤵PID:4560
-
-
-
C:\Windows\assembly\GAC\MSDATASRC\backup.exeC:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7⤵PID:4500
-
-
-
C:\Windows\assembly\GAC_32\backup.exeC:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\6⤵
- Drops file in Windows directory
PID:4092 -
C:\Windows\assembly\GAC_32\CustomMarshalers\data.exeC:\Windows\assembly\GAC_32\CustomMarshalers\data.exe C:\Windows\assembly\GAC_32\CustomMarshalers\7⤵
- Drops file in Windows directory
PID:2656 -
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe"C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\8⤵
- Modifies visibility of file extensions in Explorer
PID:4852
-
-
-
C:\Windows\assembly\GAC_32\ISymWrapper\backup.exeC:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\7⤵
- Drops file in Windows directory
PID:400 -
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\data.exeC:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\8⤵PID:1404
-
-
-
C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exeC:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:2808 -
C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\System Restore.exe"C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\System Restore.exe" C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\8⤵PID:5372
-
-
-
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exeC:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\7⤵PID:5212
-
-
-
C:\Windows\assembly\GAC_64\backup.exeC:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\6⤵
- Drops file in Windows directory
PID:1552 -
C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exeC:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\7⤵
- Drops file in Windows directory
PID:4560 -
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\8⤵
- Modifies visibility of file extensions in Explorer
PID:3148
-
-
-
C:\Windows\assembly\GAC_64\ISymWrapper\backup.exeC:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:1660 -
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\8⤵PID:5024
-
-
-
C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exeC:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\7⤵PID:2840
-
-
C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exeC:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\7⤵PID:1752
-
-
-
C:\Windows\assembly\GAC_MSIL\backup.exeC:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\6⤵
- Drops file in Windows directory
- System policy modification
PID:1812 -
C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exeC:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:2080 -
C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\8⤵
- System policy modification
PID:3872
-
-
-
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exeC:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\7⤵PID:2224
-
-
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exeC:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\6⤵PID:436
-
-
-
C:\Windows\bcastdvr\backup.exeC:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\5⤵
- Modifies visibility of file extensions in Explorer
PID:3096
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵
- Drops file in Windows directory
PID:1292 -
C:\Windows\Branding\Basebrd\backup.exeC:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:3700 -
C:\Windows\Branding\Basebrd\de-DE\backup.exeC:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\7⤵PID:4812
-
-
C:\Windows\Branding\Basebrd\en-US\backup.exeC:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\7⤵PID:212
-
-
C:\Windows\Branding\Basebrd\es-ES\backup.exeC:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\7⤵PID:4088
-
-
-
C:\Windows\Branding\shellbrd\backup.exeC:\Windows\Branding\shellbrd\backup.exe C:\Windows\Branding\shellbrd\6⤵PID:3340
-
-
-
C:\Windows\CbsTemp\backup.exeC:\Windows\CbsTemp\backup.exe C:\Windows\CbsTemp\5⤵
- System policy modification
PID:4480
-
-
C:\Windows\Containers\backup.exeC:\Windows\Containers\backup.exe C:\Windows\Containers\5⤵
- Drops file in Windows directory
PID:4612 -
C:\Windows\Containers\serviced\backup.exeC:\Windows\Containers\serviced\backup.exe C:\Windows\Containers\serviced\6⤵PID:3012
-
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵PID:2228
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2074481977\backup.exeC:\Users\Admin\AppData\Local\Temp\2074481977\backup.exe C:\Users\Admin\AppData\Local\Temp\2074481977\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3992
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3884
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exeC:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exeC:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exeC:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\1⤵PID:2268
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\1⤵PID:2172
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\1⤵PID:876
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\2⤵PID:820
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\1⤵
- Modifies visibility of file extensions in Explorer
PID:3432
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\1⤵PID:2724
-
C:\Windows\assembly\GAC\ADODB\backup.exeC:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\1⤵
- Drops file in Windows directory
PID:5060 -
C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exeC:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\2⤵PID:3396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD596b17ed77a7ab869eb3fc2050f66097c
SHA13d2b5c93a132e8632bc93f757ac8b6b6ffd52745
SHA256763ac24cb2837e1e4abd840f17d42ac3abfb51ee844aa035dc940f28a3a0257b
SHA512474d801260d1371d67d20d889fa1e53d2a2826b4a1f7fc515cd9b376400ab5bb24f303ff10716fbcac9ab96bf49fd358195bad75944a085300ffbf0e93e1ec16
-
Filesize
84KB
MD596b17ed77a7ab869eb3fc2050f66097c
SHA13d2b5c93a132e8632bc93f757ac8b6b6ffd52745
SHA256763ac24cb2837e1e4abd840f17d42ac3abfb51ee844aa035dc940f28a3a0257b
SHA512474d801260d1371d67d20d889fa1e53d2a2826b4a1f7fc515cd9b376400ab5bb24f303ff10716fbcac9ab96bf49fd358195bad75944a085300ffbf0e93e1ec16
-
Filesize
84KB
MD53b2a196f2ebf6e60a8a22e92422eb940
SHA14bc708fd6583676d9c64a8b2fbf9bfab8fe993ae
SHA2565d520f91a2cf2724318cc61b00b554deb0d9fe551b999df75e7cec655f3fee4d
SHA51274dd6e030f0d547475c6b6d580aedd2126031bea135113ee4a7642af9bb4b8d94a15392c7ef5fa1128f40560122a48459c643ffb943824a21187708b5c4a886f
-
Filesize
84KB
MD53b2a196f2ebf6e60a8a22e92422eb940
SHA14bc708fd6583676d9c64a8b2fbf9bfab8fe993ae
SHA2565d520f91a2cf2724318cc61b00b554deb0d9fe551b999df75e7cec655f3fee4d
SHA51274dd6e030f0d547475c6b6d580aedd2126031bea135113ee4a7642af9bb4b8d94a15392c7ef5fa1128f40560122a48459c643ffb943824a21187708b5c4a886f
-
Filesize
84KB
MD5d5763fe8911715bb61c18aab6d45f021
SHA1faf3430e87a659c14fe647a25a6749fdd2581d79
SHA25653feb5cac525859c7e1255893a7b278081141b52323e8c5cbe119727bddba849
SHA512d22c6b7f0a6edc430ff1a46a8b1d8d6c4273178d992375f56ab268a067af9e94306e57d3f9fff0d74380b3f4d54f4f36f59f99049d648fe0903e0987a7137c9f
-
Filesize
84KB
MD5d5763fe8911715bb61c18aab6d45f021
SHA1faf3430e87a659c14fe647a25a6749fdd2581d79
SHA25653feb5cac525859c7e1255893a7b278081141b52323e8c5cbe119727bddba849
SHA512d22c6b7f0a6edc430ff1a46a8b1d8d6c4273178d992375f56ab268a067af9e94306e57d3f9fff0d74380b3f4d54f4f36f59f99049d648fe0903e0987a7137c9f
-
Filesize
84KB
MD58f6977944b4dcba7c396545c2b5f3646
SHA1fefa62bfb0cd8651740383c6f8e5a86fa4592404
SHA256631aa403955eb3c364d0769a012d0712baa737e680c7720e2d7ee1235fe7f884
SHA512b28064bcc2e512ad427353529f4ab1fb15c797a154e4ebf13184ebf69109336d34ef372a4dcce07348b439c2040a2f85e326e270a9ff6ce3e6105b7c47402f94
-
Filesize
84KB
MD58f6977944b4dcba7c396545c2b5f3646
SHA1fefa62bfb0cd8651740383c6f8e5a86fa4592404
SHA256631aa403955eb3c364d0769a012d0712baa737e680c7720e2d7ee1235fe7f884
SHA512b28064bcc2e512ad427353529f4ab1fb15c797a154e4ebf13184ebf69109336d34ef372a4dcce07348b439c2040a2f85e326e270a9ff6ce3e6105b7c47402f94
-
Filesize
84KB
MD54a2b4eac68493ffa576f288d21018aa2
SHA195489f1971725257d2a440b295ff6d6dc3dd5fc0
SHA2564108b564b75abde6623b786aeb7027ebee6ea224e6846a18eccf3d155eeb0eaa
SHA5120fe41803a471faa9f9310b6472f6efeb28efda69581e705ce30f1ba9c322599105780aad106ad73b98b73fd57562a1afc10a97435acf223dc7e73a38c9b6ba05
-
Filesize
84KB
MD54a2b4eac68493ffa576f288d21018aa2
SHA195489f1971725257d2a440b295ff6d6dc3dd5fc0
SHA2564108b564b75abde6623b786aeb7027ebee6ea224e6846a18eccf3d155eeb0eaa
SHA5120fe41803a471faa9f9310b6472f6efeb28efda69581e705ce30f1ba9c322599105780aad106ad73b98b73fd57562a1afc10a97435acf223dc7e73a38c9b6ba05
-
Filesize
84KB
MD55191fc037f7d8e98d1d2d500f42ee045
SHA12bbb6b4e32e70b3178b98be371643b940ae0aaae
SHA2569bb0fc8f6ed771bbd19db486243434474ecaa78efb70e98e65bc1480a2aafc20
SHA5124651b8e54475cb3275d67bb94b0eddae1fe1b4f611564dff8d299cfbbce89c9de3cf00dfe079c69507fa3e7ab15a4cec115175a8b6b6e178a7ae261565f45283
-
Filesize
84KB
MD55191fc037f7d8e98d1d2d500f42ee045
SHA12bbb6b4e32e70b3178b98be371643b940ae0aaae
SHA2569bb0fc8f6ed771bbd19db486243434474ecaa78efb70e98e65bc1480a2aafc20
SHA5124651b8e54475cb3275d67bb94b0eddae1fe1b4f611564dff8d299cfbbce89c9de3cf00dfe079c69507fa3e7ab15a4cec115175a8b6b6e178a7ae261565f45283
-
Filesize
84KB
MD52cc77c7a02ba8224bd2ce34228dfbfdd
SHA155ca966b75189c3dd6e0f5240dddb6cb8c517742
SHA256eeb40de6d0723b5d0381d965a289424351edeeab60f141461baee1f5569fc604
SHA51231e784516fd4f7f86bab53d70873dbf24352660d0f1ee3b95e564422f62a4e5d3fa6d70b989063d1b5e57feed071e564202cb97dbc86aa8e5015a1408954a6e9
-
Filesize
84KB
MD52cc77c7a02ba8224bd2ce34228dfbfdd
SHA155ca966b75189c3dd6e0f5240dddb6cb8c517742
SHA256eeb40de6d0723b5d0381d965a289424351edeeab60f141461baee1f5569fc604
SHA51231e784516fd4f7f86bab53d70873dbf24352660d0f1ee3b95e564422f62a4e5d3fa6d70b989063d1b5e57feed071e564202cb97dbc86aa8e5015a1408954a6e9
-
Filesize
84KB
MD5c12c9c1dbd54fbd9f4556ea504e86d54
SHA1bca4dad8140a94aad225898cdf9c56649ade9410
SHA256a10a58f569a14bfff132485f8249c4b2146b255634fc33340caa816645ef0484
SHA512a6a8b3ac806125aa389ca355ffbf196f6fa3a7c425283139690200322be2fdd43ccf1b540e8a592c2ad58df44747a16352c1120fe6cb33fd9074c3cc3f124aae
-
Filesize
84KB
MD5c12c9c1dbd54fbd9f4556ea504e86d54
SHA1bca4dad8140a94aad225898cdf9c56649ade9410
SHA256a10a58f569a14bfff132485f8249c4b2146b255634fc33340caa816645ef0484
SHA512a6a8b3ac806125aa389ca355ffbf196f6fa3a7c425283139690200322be2fdd43ccf1b540e8a592c2ad58df44747a16352c1120fe6cb33fd9074c3cc3f124aae
-
Filesize
84KB
MD5be1edc9cbfc8b2e51f201ab25b663f28
SHA18ce5ab79c2f079384578470aaea0c973b1cceb09
SHA2568a3515e3a5c50c4089346265cebd3d9e85c005b040103f61ea26b42f3d4226e4
SHA5124f1c03858ba286de3091ef9ca5eae78afefbd99f86eb6c84e0123706b31a37b79bcb2978019dd2fe5d7ebb318b692e60e616eb72c328d53fe21d165aecf613e7
-
Filesize
84KB
MD5be1edc9cbfc8b2e51f201ab25b663f28
SHA18ce5ab79c2f079384578470aaea0c973b1cceb09
SHA2568a3515e3a5c50c4089346265cebd3d9e85c005b040103f61ea26b42f3d4226e4
SHA5124f1c03858ba286de3091ef9ca5eae78afefbd99f86eb6c84e0123706b31a37b79bcb2978019dd2fe5d7ebb318b692e60e616eb72c328d53fe21d165aecf613e7
-
Filesize
84KB
MD5d59ce373f962364a430145964abafcda
SHA1e2e485e9fcec6ac46cd69ba1d505c0cc2749a5b9
SHA256c8b992e32a9bcb1ef864c28a8b51bee8d95b3c36e68834b0b00af115a55af4b6
SHA512aa23cfd8ce05e1e00b7bfce26a2a8a74391da8e319d3a3aaf71daceef0485a01039d4beced6af0845d5b8897b090488762885f070be8651738cfdade999296ef
-
Filesize
84KB
MD5d59ce373f962364a430145964abafcda
SHA1e2e485e9fcec6ac46cd69ba1d505c0cc2749a5b9
SHA256c8b992e32a9bcb1ef864c28a8b51bee8d95b3c36e68834b0b00af115a55af4b6
SHA512aa23cfd8ce05e1e00b7bfce26a2a8a74391da8e319d3a3aaf71daceef0485a01039d4beced6af0845d5b8897b090488762885f070be8651738cfdade999296ef
-
Filesize
84KB
MD5c6347d903b0bef4c2f97ff9162fe906c
SHA13ea83e29183d4f779f501d6e56f5370a7c2df191
SHA256db4dcf6137afb08c9956cf53df6664f83e4338e9a7437cafc697acc4932f6e8d
SHA512ffcf289b4da6caa6e3d796a7926ea6d52b2322a8393d1e577044b194fec95f15ab75ae820b39c8787db2a2f4634361d97eb884f385acb2a841388a537d3c2ede
-
Filesize
84KB
MD5c6347d903b0bef4c2f97ff9162fe906c
SHA13ea83e29183d4f779f501d6e56f5370a7c2df191
SHA256db4dcf6137afb08c9956cf53df6664f83e4338e9a7437cafc697acc4932f6e8d
SHA512ffcf289b4da6caa6e3d796a7926ea6d52b2322a8393d1e577044b194fec95f15ab75ae820b39c8787db2a2f4634361d97eb884f385acb2a841388a537d3c2ede
-
Filesize
84KB
MD54aed2be2a4b90f32b9c73c03b7f8e54a
SHA1ecc7e553d7e94514be9e27d8f3c39e5437718347
SHA2560cfbc4cc456ecbfb7440fedb9077a3126108ef01b1d8b5791396b3e27b829e13
SHA5126ff9042b67b87f87247ff90a211eb4bbf086a80122e40f72bc52ba4e8537d89a560747c8e9bff11bc4ef54cecdece8f5a1230eee8b8423361042adcde803c989
-
Filesize
84KB
MD54aed2be2a4b90f32b9c73c03b7f8e54a
SHA1ecc7e553d7e94514be9e27d8f3c39e5437718347
SHA2560cfbc4cc456ecbfb7440fedb9077a3126108ef01b1d8b5791396b3e27b829e13
SHA5126ff9042b67b87f87247ff90a211eb4bbf086a80122e40f72bc52ba4e8537d89a560747c8e9bff11bc4ef54cecdece8f5a1230eee8b8423361042adcde803c989
-
Filesize
84KB
MD525a2cf213b34410f8100a8475620b320
SHA198b61aadf3b732c57d5e38d614cca5079e46bbfd
SHA25696ce30db46e9a7b0c410b0bcbfdb922a843863218ed9c8f5647bd89055bc70a7
SHA5123f2436927acdba2cb2a3f608c2f8ff6c51d6c5e0240e8f14b00d5c8e2324eabf25f1d5f0044eeb058f222043a455357a95a3591452a43220c048be8a29462122
-
Filesize
84KB
MD525a2cf213b34410f8100a8475620b320
SHA198b61aadf3b732c57d5e38d614cca5079e46bbfd
SHA25696ce30db46e9a7b0c410b0bcbfdb922a843863218ed9c8f5647bd89055bc70a7
SHA5123f2436927acdba2cb2a3f608c2f8ff6c51d6c5e0240e8f14b00d5c8e2324eabf25f1d5f0044eeb058f222043a455357a95a3591452a43220c048be8a29462122
-
Filesize
84KB
MD5ba0a5a87de1b1177ba806fe986211982
SHA102422a4b325d7d17df46afabe8cb4e302d2045b0
SHA2561ed65e7f594376956c4dca87021ce5e5405ebbb893e194ad4ee221550a69957a
SHA512c1ba61db70ec021be4af6d3c2eaf27c3109d8c29ab1970baa87384241e4c7b97757d950a49268a4d6525b084b27a39617c92b479aa52ba1e9f66467ffff359d0
-
Filesize
84KB
MD5ba0a5a87de1b1177ba806fe986211982
SHA102422a4b325d7d17df46afabe8cb4e302d2045b0
SHA2561ed65e7f594376956c4dca87021ce5e5405ebbb893e194ad4ee221550a69957a
SHA512c1ba61db70ec021be4af6d3c2eaf27c3109d8c29ab1970baa87384241e4c7b97757d950a49268a4d6525b084b27a39617c92b479aa52ba1e9f66467ffff359d0
-
Filesize
84KB
MD563e7b6c6fb71b0abb3eb0fab20f11084
SHA15ca80e3be5848d38527286c576dfc125cc6412ee
SHA256bbeba469ac02198898fb3f52b39aabf3b66bd914321219f8257145364fa6a1a1
SHA51292c0b79a39c6ca5dde78d3824927591557e58dbf955ca069065ea8e30cbe0074036a7b74f2a7b39e4adef7dd668df5e43959f4b7008d23ef33beefec809fa35c
-
Filesize
84KB
MD563e7b6c6fb71b0abb3eb0fab20f11084
SHA15ca80e3be5848d38527286c576dfc125cc6412ee
SHA256bbeba469ac02198898fb3f52b39aabf3b66bd914321219f8257145364fa6a1a1
SHA51292c0b79a39c6ca5dde78d3824927591557e58dbf955ca069065ea8e30cbe0074036a7b74f2a7b39e4adef7dd668df5e43959f4b7008d23ef33beefec809fa35c
-
Filesize
84KB
MD5a231e46f175b25cffed831266be33d13
SHA10d5a8f2c30323f523556fef494071829d6c95649
SHA256cc9f7140241c28cfad5d1df4dc9ae0e12c139be12e7be2fa845caf61cd84e229
SHA512fb7c9c1129103765d85e003cc172f380231caab5af112f398a939fa9f48e76487ed95a78ca8767a9a1ec6b8ac8b8fe8d3d3eb58cd10bf213ef1d740077085626
-
Filesize
84KB
MD5a231e46f175b25cffed831266be33d13
SHA10d5a8f2c30323f523556fef494071829d6c95649
SHA256cc9f7140241c28cfad5d1df4dc9ae0e12c139be12e7be2fa845caf61cd84e229
SHA512fb7c9c1129103765d85e003cc172f380231caab5af112f398a939fa9f48e76487ed95a78ca8767a9a1ec6b8ac8b8fe8d3d3eb58cd10bf213ef1d740077085626
-
Filesize
84KB
MD5a7309d42578cb7de25c889843f9c1997
SHA1db5550c614904b2b47a02d18191b07181869e77c
SHA25667663e0692548da47608b49676c32fd16e7fe7e863cb48476364880585c3aab4
SHA5125b4b3a68276099268f54a2e1e626712bbc975d7c2d24d4fc527e78856e8a456dd401e6b6f81415640191b3ca674b9e483c97df92b5c9ac4825f6ec88fde4f3f0
-
Filesize
84KB
MD5a7309d42578cb7de25c889843f9c1997
SHA1db5550c614904b2b47a02d18191b07181869e77c
SHA25667663e0692548da47608b49676c32fd16e7fe7e863cb48476364880585c3aab4
SHA5125b4b3a68276099268f54a2e1e626712bbc975d7c2d24d4fc527e78856e8a456dd401e6b6f81415640191b3ca674b9e483c97df92b5c9ac4825f6ec88fde4f3f0
-
Filesize
84KB
MD596b17ed77a7ab869eb3fc2050f66097c
SHA13d2b5c93a132e8632bc93f757ac8b6b6ffd52745
SHA256763ac24cb2837e1e4abd840f17d42ac3abfb51ee844aa035dc940f28a3a0257b
SHA512474d801260d1371d67d20d889fa1e53d2a2826b4a1f7fc515cd9b376400ab5bb24f303ff10716fbcac9ab96bf49fd358195bad75944a085300ffbf0e93e1ec16
-
Filesize
84KB
MD596b17ed77a7ab869eb3fc2050f66097c
SHA13d2b5c93a132e8632bc93f757ac8b6b6ffd52745
SHA256763ac24cb2837e1e4abd840f17d42ac3abfb51ee844aa035dc940f28a3a0257b
SHA512474d801260d1371d67d20d889fa1e53d2a2826b4a1f7fc515cd9b376400ab5bb24f303ff10716fbcac9ab96bf49fd358195bad75944a085300ffbf0e93e1ec16
-
Filesize
84KB
MD5c0d8cf6245e1e36dfbdf68a3d61258ab
SHA1964b6031b2a135eb87d5331e6c162f3c5a5b2560
SHA256a5d1f51b40b20e57a669ad2e30b5f7aa00ea8a80415ca505c51ecd2c6c743c16
SHA5124fb6a58911f4f281c79a48e4340a489c30d01f08552afc66c61b2e03d5c40c2c0c470e01bd7d816016fe63432487f011a6a753d413e735c2b4c40dd00f7d50a2
-
Filesize
84KB
MD5c0d8cf6245e1e36dfbdf68a3d61258ab
SHA1964b6031b2a135eb87d5331e6c162f3c5a5b2560
SHA256a5d1f51b40b20e57a669ad2e30b5f7aa00ea8a80415ca505c51ecd2c6c743c16
SHA5124fb6a58911f4f281c79a48e4340a489c30d01f08552afc66c61b2e03d5c40c2c0c470e01bd7d816016fe63432487f011a6a753d413e735c2b4c40dd00f7d50a2
-
Filesize
84KB
MD5c0d8cf6245e1e36dfbdf68a3d61258ab
SHA1964b6031b2a135eb87d5331e6c162f3c5a5b2560
SHA256a5d1f51b40b20e57a669ad2e30b5f7aa00ea8a80415ca505c51ecd2c6c743c16
SHA5124fb6a58911f4f281c79a48e4340a489c30d01f08552afc66c61b2e03d5c40c2c0c470e01bd7d816016fe63432487f011a6a753d413e735c2b4c40dd00f7d50a2
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD513d76f563fdfd7273968455e05231b0b
SHA1f742a0908e2a0c5d882aa2a333da1822f90ee290
SHA256a7a75012120f833cbb20c94a79855c67fcff9209923cc3013bb9e18b7b143df5
SHA512dede9dea827bcc2a6f566b421ebfe837a9686e90732c442e7b65703d1185e75c121de28365152f5cb302431b6c7e7af99bb932512f8127db7c403e28e356175e
-
Filesize
84KB
MD513d76f563fdfd7273968455e05231b0b
SHA1f742a0908e2a0c5d882aa2a333da1822f90ee290
SHA256a7a75012120f833cbb20c94a79855c67fcff9209923cc3013bb9e18b7b143df5
SHA512dede9dea827bcc2a6f566b421ebfe837a9686e90732c442e7b65703d1185e75c121de28365152f5cb302431b6c7e7af99bb932512f8127db7c403e28e356175e
-
Filesize
84KB
MD55457382b64d0fa0de82f5b8448c88b2a
SHA1898ac4982d47a6f9d3fed449611a80f2c5db9549
SHA2565e1118361f57b3a3558bc2ed64de53ae5066ecb6f909897789b8544ac18a022c
SHA51221a84e82283cae6952e1eb263602d96f1dfaf06b9a33d4d272b3590fe87b088146a76b7d49998181f998a4c91285149b84b7751381c9fa9648f2b81f07d2b383
-
Filesize
84KB
MD55457382b64d0fa0de82f5b8448c88b2a
SHA1898ac4982d47a6f9d3fed449611a80f2c5db9549
SHA2565e1118361f57b3a3558bc2ed64de53ae5066ecb6f909897789b8544ac18a022c
SHA51221a84e82283cae6952e1eb263602d96f1dfaf06b9a33d4d272b3590fe87b088146a76b7d49998181f998a4c91285149b84b7751381c9fa9648f2b81f07d2b383
-
Filesize
84KB
MD51b34d75aadc6b3efd9352dec379d3da3
SHA1156027a020d5b6a16ab1400666f62e1737ebdf48
SHA2560b4366f7b911d51e234e0f3c75c371e9fe3cba6fb96f9c42789b7e36cfa5e04d
SHA512d1ee2cb1b469dc3aba4e3808f29b44da3dcae3627682ffe1a55edb82c33ce1467f668167a162bd4fa150448cdde76b65af1e568eb1ed220abf93bd713bc0065d
-
Filesize
84KB
MD51b34d75aadc6b3efd9352dec379d3da3
SHA1156027a020d5b6a16ab1400666f62e1737ebdf48
SHA2560b4366f7b911d51e234e0f3c75c371e9fe3cba6fb96f9c42789b7e36cfa5e04d
SHA512d1ee2cb1b469dc3aba4e3808f29b44da3dcae3627682ffe1a55edb82c33ce1467f668167a162bd4fa150448cdde76b65af1e568eb1ed220abf93bd713bc0065d
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
84KB
MD5fa4722e6b4efb86641ae2d0d125b2cbd
SHA1b02911cea9420452525180fcb5137732415d7145
SHA256518e0bdcc61e44e076c88ede2fc5cdc28bcb70999b53e50fefa28f09d01e4425
SHA51201da1624d64db36fae24524f11726f93a13cb296587ddeb80973cd28c666db9208e26abf3b8dd972a1652e8178b8948e53c84447f6cdbad1385c7a0b79e608ec
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
30KB
MD5aba06c3ede6b2fad84c2649e274e7a13
SHA14491d110ab53c4c3bd0d1b6fd056390883451b1a
SHA25651d898190215091b7d8df37856df09a1eff06ec1c2dd37d70b4dc57cc4d13101
SHA5127619cc528258e7f8a0faf05eed7b3cf04daaa55a07c97a59baa840ad8803c191370e366a60d527bde5e1a964922ce1236e47a8fa8f6db643ca8f08a0d0cfb23c
-
Filesize
84KB
MD5c0d8cf6245e1e36dfbdf68a3d61258ab
SHA1964b6031b2a135eb87d5331e6c162f3c5a5b2560
SHA256a5d1f51b40b20e57a669ad2e30b5f7aa00ea8a80415ca505c51ecd2c6c743c16
SHA5124fb6a58911f4f281c79a48e4340a489c30d01f08552afc66c61b2e03d5c40c2c0c470e01bd7d816016fe63432487f011a6a753d413e735c2b4c40dd00f7d50a2
-
Filesize
84KB
MD5c0d8cf6245e1e36dfbdf68a3d61258ab
SHA1964b6031b2a135eb87d5331e6c162f3c5a5b2560
SHA256a5d1f51b40b20e57a669ad2e30b5f7aa00ea8a80415ca505c51ecd2c6c743c16
SHA5124fb6a58911f4f281c79a48e4340a489c30d01f08552afc66c61b2e03d5c40c2c0c470e01bd7d816016fe63432487f011a6a753d413e735c2b4c40dd00f7d50a2
-
Filesize
84KB
MD55335b8d16efae54f0867c7b6d93750cb
SHA1315bb72a8e3628a6ebe1a4bc601a386fc7acabcd
SHA256544ccd5c2d1c4dbc9c65b5ef0aaa1d92d7636485fda29803e891a4e64521f926
SHA5122b124ec76f20e37d4c902d10fb93255911aad291405556896bc43cd3c00e6be576f60d1a06f07600d23021ccdfe80d9788ae5c91e2949a166104ce34bdf645ef
-
Filesize
84KB
MD55335b8d16efae54f0867c7b6d93750cb
SHA1315bb72a8e3628a6ebe1a4bc601a386fc7acabcd
SHA256544ccd5c2d1c4dbc9c65b5ef0aaa1d92d7636485fda29803e891a4e64521f926
SHA5122b124ec76f20e37d4c902d10fb93255911aad291405556896bc43cd3c00e6be576f60d1a06f07600d23021ccdfe80d9788ae5c91e2949a166104ce34bdf645ef
-
Filesize
84KB
MD5b66bf96259da0e5fec20180193977092
SHA11aabcda4aa07f6ea1057bfd758aca26defe4774c
SHA256b084abec93c2b5b506ec1875cc00baf7256ac44d3d31fd73b080a90bd2f31145
SHA5126829d4eb5ed146534780f257cd182d9f6a0542af50d098e2ea90d523540c52e981453243893de726400b6d4e7c51a8f8bf4a9d67c5b2e967b5867c4ee0302a91
-
Filesize
84KB
MD5b66bf96259da0e5fec20180193977092
SHA11aabcda4aa07f6ea1057bfd758aca26defe4774c
SHA256b084abec93c2b5b506ec1875cc00baf7256ac44d3d31fd73b080a90bd2f31145
SHA5126829d4eb5ed146534780f257cd182d9f6a0542af50d098e2ea90d523540c52e981453243893de726400b6d4e7c51a8f8bf4a9d67c5b2e967b5867c4ee0302a91
-
Filesize
84KB
MD596b17ed77a7ab869eb3fc2050f66097c
SHA13d2b5c93a132e8632bc93f757ac8b6b6ffd52745
SHA256763ac24cb2837e1e4abd840f17d42ac3abfb51ee844aa035dc940f28a3a0257b
SHA512474d801260d1371d67d20d889fa1e53d2a2826b4a1f7fc515cd9b376400ab5bb24f303ff10716fbcac9ab96bf49fd358195bad75944a085300ffbf0e93e1ec16
-
Filesize
84KB
MD596b17ed77a7ab869eb3fc2050f66097c
SHA13d2b5c93a132e8632bc93f757ac8b6b6ffd52745
SHA256763ac24cb2837e1e4abd840f17d42ac3abfb51ee844aa035dc940f28a3a0257b
SHA512474d801260d1371d67d20d889fa1e53d2a2826b4a1f7fc515cd9b376400ab5bb24f303ff10716fbcac9ab96bf49fd358195bad75944a085300ffbf0e93e1ec16