Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 06:46
Behavioral task
behavioral1
Sample
NEAS.c951caf1483ab52587848c19617cc010.exe
Resource
win7-20231025-en
General
-
Target
NEAS.c951caf1483ab52587848c19617cc010.exe
-
Size
371KB
-
MD5
c951caf1483ab52587848c19617cc010
-
SHA1
98e7373ecf3e43fc2e9707c37cbf6d2c9291b92b
-
SHA256
b96ba8321ea0aab62fa27f1a53094cbc38b0233356fc9e7d4659928c07612cf2
-
SHA512
7131e9f366c9f445a03eca4581f3523ed608729a7effc2655cf0cd03fd9c142ab7b5ac060365cd16fac50724234acb2fa6a100f2e636f5734becc72250218376
-
SSDEEP
3072:BmVwRKCb75xkX+Sy37JhLomyxyFa656WexiQ+76U75xVErRt3Lo7M:BmVnE6+RUmGXWkYm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2964 backup.exe 1140 backup.exe 2104 backup.exe 2728 backup.exe 2784 backup.exe 2576 backup.exe 2488 backup.exe 2648 backup.exe 2456 backup.exe 2544 backup.exe 1520 backup.exe 2788 backup.exe 676 backup.exe 2992 backup.exe 1996 backup.exe 1076 backup.exe 1724 update.exe 1052 backup.exe 2124 backup.exe 1092 backup.exe 560 data.exe 3060 backup.exe 2116 data.exe 872 backup.exe 1720 backup.exe 2968 backup.exe 1824 backup.exe 2336 backup.exe 2716 backup.exe 2484 backup.exe 2784 backup.exe 2612 backup.exe 2496 backup.exe 3004 backup.exe 2856 backup.exe 2688 backup.exe 1540 backup.exe 1956 backup.exe 2816 backup.exe 1280 backup.exe 1136 backup.exe 2996 backup.exe 2220 backup.exe 1740 backup.exe 1816 backup.exe 2160 backup.exe 1688 backup.exe 1488 backup.exe 1664 backup.exe 944 backup.exe 1440 backup.exe 668 backup.exe 1984 backup.exe 3060 backup.exe 1620 backup.exe 2244 backup.exe 1604 backup.exe 1744 backup.exe 1944 backup.exe 2616 backup.exe 2744 backup.exe 2608 backup.exe 2824 backup.exe 2476 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 2488 backup.exe 2488 backup.exe 2456 backup.exe 2456 backup.exe 2488 backup.exe 2488 backup.exe 1520 backup.exe 1520 backup.exe 2788 backup.exe 2788 backup.exe 1520 backup.exe 1520 backup.exe 2992 backup.exe 2992 backup.exe 1996 backup.exe 1996 backup.exe 1996 backup.exe 1724 update.exe 1724 update.exe 1724 update.exe 1724 update.exe 1724 update.exe 1052 backup.exe 1052 backup.exe 1052 backup.exe 1724 update.exe 1724 update.exe 2124 backup.exe 2124 backup.exe 2124 backup.exe 1724 update.exe 1724 update.exe 1092 backup.exe 1092 backup.exe 1092 backup.exe 1724 update.exe 1724 update.exe 560 data.exe 560 data.exe 560 data.exe 1724 update.exe 1724 update.exe 3060 backup.exe 3060 backup.exe 3060 backup.exe 1724 update.exe 1724 update.exe 2116 data.exe 2116 data.exe 2116 data.exe -
resource yara_rule behavioral1/memory/1676-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x001b000000015474-5.dat upx behavioral1/files/0x001b000000015474-7.dat upx behavioral1/files/0x001b000000015474-9.dat upx behavioral1/files/0x001b000000015474-11.dat upx behavioral1/files/0x0007000000015c0c-15.dat upx behavioral1/files/0x0007000000015c0c-17.dat upx behavioral1/files/0x0007000000015c0c-22.dat upx behavioral1/memory/1676-21-0x00000000002A0000-0x00000000002BC000-memory.dmp upx behavioral1/memory/1140-23-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1140-27-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0007000000015c30-28.dat upx behavioral1/files/0x0007000000015c30-30.dat upx behavioral1/files/0x0007000000015c30-35.dat upx behavioral1/files/0x0008000000015c22-42.dat upx behavioral1/memory/1676-41-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0008000000015c22-39.dat upx behavioral1/files/0x0008000000015c22-47.dat upx behavioral1/files/0x0009000000015c57-59.dat upx behavioral1/files/0x0009000000015c57-55.dat upx behavioral1/memory/2728-53-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0009000000015c57-52.dat upx behavioral1/memory/2964-63-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2784-65-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x001f000000015586-69.dat upx behavioral1/files/0x001f000000015586-74.dat upx behavioral1/files/0x001f000000015586-67.dat upx behavioral1/files/0x001b000000015474-78.dat upx behavioral1/memory/2576-86-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0006000000015c97-85.dat upx behavioral1/files/0x0006000000015ca9-87.dat upx behavioral1/files/0x0006000000015ca9-90.dat upx behavioral1/memory/2104-95-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0006000000015ca9-96.dat upx behavioral1/files/0x0006000000015c97-99.dat upx behavioral1/files/0x0006000000015cc9-101.dat upx behavioral1/memory/2648-110-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0006000000015cc9-108.dat upx behavioral1/files/0x0006000000015cc9-104.dat upx behavioral1/memory/1676-103-0x00000000002A0000-0x00000000002BC000-memory.dmp upx behavioral1/files/0x0006000000015cc9-114.dat upx behavioral1/files/0x0006000000015e03-116.dat upx behavioral1/files/0x0006000000015e03-118.dat upx behavioral1/files/0x0006000000015e03-122.dat upx behavioral1/memory/2544-126-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2456-127-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0006000000015ea6-134.dat upx behavioral1/files/0x0006000000015ea6-130.dat upx behavioral1/files/0x0006000000015ea6-128.dat upx behavioral1/memory/2488-139-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1520-141-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0006000000015ea6-155.dat upx behavioral1/files/0x0007000000015eba-157.dat upx behavioral1/files/0x0007000000015eba-159.dat upx behavioral1/files/0x0007000000015eba-163.dat upx behavioral1/files/0x0007000000015eba-166.dat upx behavioral1/files/0x0006000000016050-168.dat upx behavioral1/files/0x0006000000016050-171.dat upx behavioral1/files/0x0006000000016050-175.dat upx behavioral1/memory/2788-183-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/676-182-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x000600000001625c-186.dat upx behavioral1/files/0x000600000001625c-191.dat upx behavioral1/memory/1520-192-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\update.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe update.exe File opened for modification C:\Program Files\DVD Maker\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1676 NEAS.c951caf1483ab52587848c19617cc010.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 2964 backup.exe 1140 backup.exe 2104 backup.exe 2728 backup.exe 2784 backup.exe 2576 backup.exe 2488 backup.exe 2648 backup.exe 2456 backup.exe 2544 backup.exe 1520 backup.exe 2788 backup.exe 676 backup.exe 2992 backup.exe 1996 backup.exe 1076 backup.exe 1724 update.exe 1052 backup.exe 2124 backup.exe 1092 backup.exe 560 data.exe 3060 backup.exe 2116 data.exe 872 backup.exe 1720 backup.exe 2968 backup.exe 1824 backup.exe 2336 backup.exe 2716 backup.exe 2484 backup.exe 2784 backup.exe 2612 backup.exe 2496 backup.exe 3004 backup.exe 2856 backup.exe 2688 backup.exe 1540 backup.exe 1956 backup.exe 2816 backup.exe 1280 backup.exe 1136 backup.exe 2996 backup.exe 2220 backup.exe 1740 backup.exe 1816 backup.exe 2160 backup.exe 1688 backup.exe 1488 backup.exe 1664 backup.exe 944 backup.exe 1440 backup.exe 668 backup.exe 1984 backup.exe 3060 backup.exe 1620 backup.exe 2244 backup.exe 1604 backup.exe 1744 backup.exe 1944 backup.exe 2616 backup.exe 2744 backup.exe 2608 backup.exe 2824 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2964 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 28 PID 1676 wrote to memory of 2964 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 28 PID 1676 wrote to memory of 2964 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 28 PID 1676 wrote to memory of 2964 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 28 PID 1676 wrote to memory of 1140 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 29 PID 1676 wrote to memory of 1140 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 29 PID 1676 wrote to memory of 1140 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 29 PID 1676 wrote to memory of 1140 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 29 PID 1676 wrote to memory of 2104 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 30 PID 1676 wrote to memory of 2104 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 30 PID 1676 wrote to memory of 2104 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 30 PID 1676 wrote to memory of 2104 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 30 PID 1676 wrote to memory of 2728 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 31 PID 1676 wrote to memory of 2728 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 31 PID 1676 wrote to memory of 2728 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 31 PID 1676 wrote to memory of 2728 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 31 PID 1676 wrote to memory of 2784 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 32 PID 1676 wrote to memory of 2784 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 32 PID 1676 wrote to memory of 2784 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 32 PID 1676 wrote to memory of 2784 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 32 PID 1676 wrote to memory of 2576 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 33 PID 1676 wrote to memory of 2576 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 33 PID 1676 wrote to memory of 2576 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 33 PID 1676 wrote to memory of 2576 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 33 PID 2964 wrote to memory of 2488 2964 backup.exe 34 PID 2964 wrote to memory of 2488 2964 backup.exe 34 PID 2964 wrote to memory of 2488 2964 backup.exe 34 PID 2964 wrote to memory of 2488 2964 backup.exe 34 PID 1676 wrote to memory of 2648 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 35 PID 1676 wrote to memory of 2648 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 35 PID 1676 wrote to memory of 2648 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 35 PID 1676 wrote to memory of 2648 1676 NEAS.c951caf1483ab52587848c19617cc010.exe 35 PID 2488 wrote to memory of 2456 2488 backup.exe 36 PID 2488 wrote to memory of 2456 2488 backup.exe 36 PID 2488 wrote to memory of 2456 2488 backup.exe 36 PID 2488 wrote to memory of 2456 2488 backup.exe 36 PID 2456 wrote to memory of 2544 2456 backup.exe 37 PID 2456 wrote to memory of 2544 2456 backup.exe 37 PID 2456 wrote to memory of 2544 2456 backup.exe 37 PID 2456 wrote to memory of 2544 2456 backup.exe 37 PID 2488 wrote to memory of 1520 2488 backup.exe 38 PID 2488 wrote to memory of 1520 2488 backup.exe 38 PID 2488 wrote to memory of 1520 2488 backup.exe 38 PID 2488 wrote to memory of 1520 2488 backup.exe 38 PID 1520 wrote to memory of 2788 1520 backup.exe 39 PID 1520 wrote to memory of 2788 1520 backup.exe 39 PID 1520 wrote to memory of 2788 1520 backup.exe 39 PID 1520 wrote to memory of 2788 1520 backup.exe 39 PID 2788 wrote to memory of 676 2788 backup.exe 40 PID 2788 wrote to memory of 676 2788 backup.exe 40 PID 2788 wrote to memory of 676 2788 backup.exe 40 PID 2788 wrote to memory of 676 2788 backup.exe 40 PID 1520 wrote to memory of 2992 1520 backup.exe 41 PID 1520 wrote to memory of 2992 1520 backup.exe 41 PID 1520 wrote to memory of 2992 1520 backup.exe 41 PID 1520 wrote to memory of 2992 1520 backup.exe 41 PID 2992 wrote to memory of 1996 2992 backup.exe 42 PID 2992 wrote to memory of 1996 2992 backup.exe 42 PID 2992 wrote to memory of 1996 2992 backup.exe 42 PID 2992 wrote to memory of 1996 2992 backup.exe 42 PID 1996 wrote to memory of 1076 1996 backup.exe 43 PID 1996 wrote to memory of 1076 1996 backup.exe 43 PID 1996 wrote to memory of 1076 1996 backup.exe 43 PID 1996 wrote to memory of 1076 1996 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NEAS.c951caf1483ab52587848c19617cc010.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" NEAS.c951caf1483ab52587848c19617cc010.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c951caf1483ab52587848c19617cc010.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c951caf1483ab52587848c19617cc010.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\245815316\backup.exeC:\Users\Admin\AppData\Local\Temp\245815316\backup.exe C:\Users\Admin\AppData\Local\Temp\245815316\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2964 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2456 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2544
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2788 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:676
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2992 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1996 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1076
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2116
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2716 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2484
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1956
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1280
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2244
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2744
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2824
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:2476 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2548
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:3000
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2652
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3004
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2396
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1624
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1448 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1524
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
PID:2796
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1084
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1280 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- System policy modification
PID:2848
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:3012
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1428
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1536
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:888 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2112
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- System policy modification
PID:1976
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1572
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:2592
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1676
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:2648
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:2396
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:3068
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2080
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:2220
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:836
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:2616
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:2528
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵PID:1672
-
-
-
C:\Program Files\Common Files\System\update.exe"C:\Program Files\Common Files\System\update.exe" C:\Program Files\Common Files\System\6⤵PID:1452
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:484
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1892
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1440
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:2632
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1616
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1540
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1184
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:2264
-
-
C:\Program Files\Common Files\System\en-US\System Restore.exe"C:\Program Files\Common Files\System\en-US\System Restore.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:2636
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1896
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1124
-
-
C:\Program Files\Common Files\System\it-IT\System Restore.exe"C:\Program Files\Common Files\System\it-IT\System Restore.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1912
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2120
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1424
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1676
-
-
-
-
C:\Program Files\DVD Maker\System Restore.exe"C:\Program Files\DVD Maker\System Restore.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2140 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵PID:2768
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1988
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:2864
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:2464
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:656
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:524
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:2076
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1820
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:2092
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:3032
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1584
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:528
-
-
C:\Program Files\Microsoft Office\update.exe"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\5⤵PID:344
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1816
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:1432
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2592
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:1388
-
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\5⤵PID:636
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
- System policy modification
PID:1648 -
C:\Program Files (x86)\Adobe\update.exe"C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1940 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1796 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵PID:1732
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
- System policy modification
PID:2116 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
PID:3040
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:2228
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1580
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:2244
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:2680
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1948
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1392
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1096
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:2916
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:2608
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2224
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:2124
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:2956
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:2968
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2500
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:2480
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1288
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵PID:2788
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:2872
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1456
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1788
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:2904
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:2028
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1608
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\update.exe"C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1128
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵PID:1044
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1268
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2568
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1928
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:1148
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1256
-
-
C:\Program Files (x86)\Internet Explorer\update.exe"C:\Program Files (x86)\Internet Explorer\update.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1576
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:1628
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:1956
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:2892
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:1552
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\update.exe"C:\Program Files (x86)\Microsoft Analysis Services\update.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2876
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵PID:1932
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:108
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\5⤵PID:1652
-
-
C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\5⤵PID:1528
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1688
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:972
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:2932
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:2328
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:2540
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:2544
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:760
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2948
-
-
C:\Windows\Branding\System Restore.exe"C:\Windows\Branding\System Restore.exe" C:\Windows\Branding\5⤵PID:1112
-
C:\Windows\Branding\Basebrd\backup.exeC:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\6⤵PID:1752
-
-
C:\Windows\Branding\ShellBrd\backup.exeC:\Windows\Branding\ShellBrd\backup.exe C:\Windows\Branding\ShellBrd\6⤵PID:2812
-
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:3060
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵PID:2720
-
-
C:\Windows\debug\backup.exeC:\Windows\debug\backup.exe C:\Windows\debug\5⤵PID:2032
-
-
C:\Windows\de-DE\backup.exeC:\Windows\de-DE\backup.exe C:\Windows\de-DE\5⤵PID:1468
-
-
C:\Windows\DigitalLocker\backup.exeC:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\5⤵PID:688
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1140
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
371KB
MD57ae8024a42d561433ed6f7dc3faef1c5
SHA1c0be8b31ba09051fe61b8b7bfe018bf28d4d32ad
SHA2563d85155ccc3f3ca9c0748366629a1c01732cf035e43131fbb70ca33fe11b059a
SHA5121aca8fb73841f85286e8da4d43197e0b15f3c3badde6b733520c0fb2bd12b9ceb8b7df344ad0858eea1edafb03547fbaed4c001759f25b501961f7f5881f64f6
-
Filesize
371KB
MD547c522c313242a20501b1c0b3312fe77
SHA11cb1ff05ca865496fbb54919233c17665e7f76e5
SHA25685addb503ea360a87e105a076e697fc7be63383573b9a81a607bb936052f3b58
SHA512c9793ede92e138706b5131ddba3b6680b9a8364e6b34568cf759e84226cf813d9857959a5d7995cdced03077d74b3cb5cbdd21cfc83567c9f4a62e4115d95297
-
Filesize
371KB
MD547c522c313242a20501b1c0b3312fe77
SHA11cb1ff05ca865496fbb54919233c17665e7f76e5
SHA25685addb503ea360a87e105a076e697fc7be63383573b9a81a607bb936052f3b58
SHA512c9793ede92e138706b5131ddba3b6680b9a8364e6b34568cf759e84226cf813d9857959a5d7995cdced03077d74b3cb5cbdd21cfc83567c9f4a62e4115d95297
-
Filesize
371KB
MD54f80d694b0d65c2b1078f5d31ca5ec29
SHA1cc6f76f1dd652a9bbb8056d68f8fed0f21f29585
SHA256dfdf6a4294955e029c43f40dc55fd233fc822a2af3f3e3d6bb51e255b3a51015
SHA5127e67acacb5a5c3c6a29493f06f7cd33210895554f1a7bc4a988839a2ddf0f888e8467a786222d31cc7c4297dc2be6267090e22c3b3f991db4a3aea9f4985fd12
-
Filesize
371KB
MD5775b590199e947e9e8b1fc6729cf8363
SHA17339f2cd8c01d752bc968bad3c2ee448ebc73639
SHA2562b46b4d947e11b6be4cee20937d19573039f8a16075cdbb43d5ed26eaff1a9c1
SHA5121d4c5ed60340d827e0aec4c8f070b67a046f50c12ba878b67e6af9dc88c24080069c02d86a07a90c2c50c94de0d40ab4e0f364c31ceb58d1e0d2966d0294e840
-
Filesize
371KB
MD5775b590199e947e9e8b1fc6729cf8363
SHA17339f2cd8c01d752bc968bad3c2ee448ebc73639
SHA2562b46b4d947e11b6be4cee20937d19573039f8a16075cdbb43d5ed26eaff1a9c1
SHA5121d4c5ed60340d827e0aec4c8f070b67a046f50c12ba878b67e6af9dc88c24080069c02d86a07a90c2c50c94de0d40ab4e0f364c31ceb58d1e0d2966d0294e840
-
Filesize
371KB
MD529c11aec013e71451089c6c0fbdbbd87
SHA1a1f8a5581a148fef160aa82bf5b2e9929210e18e
SHA25657e5483f89ffeb3972829ba6f677d13b408ec30d639ff769aeeb4c9a523b9e2b
SHA51227f4c0130c6c55337d8788faed1bfc84539d950eb398cbf889d2668f76c77b3103dacb148224d8e262d6d6d9d9c3f165f79acc469d8443903af522ffa1401bbb
-
Filesize
371KB
MD592aabc2dec9534a07f6d8280421bcc50
SHA12a73fc3e9cf54f58af35c99b0c26c974f9621f39
SHA2560e6585318affc42508228692f17d2d0c721379ff7023c285deea7120e705c1aa
SHA5125d46da5c46ac6b174d29f641e0c6aeaec904f2c9b54944957dded814cd6f059337ab058223c71ba1cfa7f620e7eee96e46d127f54f489f5b3ff95b1b12870411
-
Filesize
371KB
MD592aabc2dec9534a07f6d8280421bcc50
SHA12a73fc3e9cf54f58af35c99b0c26c974f9621f39
SHA2560e6585318affc42508228692f17d2d0c721379ff7023c285deea7120e705c1aa
SHA5125d46da5c46ac6b174d29f641e0c6aeaec904f2c9b54944957dded814cd6f059337ab058223c71ba1cfa7f620e7eee96e46d127f54f489f5b3ff95b1b12870411
-
Filesize
371KB
MD574a5e72835ee125b68f748310bf767f6
SHA1dfa8e71380bed7c04e8674fb4673dcc94f0a8377
SHA2568f67ae8a316b77c449ed45bdbf935ae3068caa6bcb3d13a2b427589bb23b4d5b
SHA51253b444efef4c760aa247df7bfe7dad6354f991fffcbe036a2ee345e1c084c4d718abf68655b7682ffafd028e9ba4939f622bb0696664955d21b88e8693634d66
-
Filesize
371KB
MD574a5e72835ee125b68f748310bf767f6
SHA1dfa8e71380bed7c04e8674fb4673dcc94f0a8377
SHA2568f67ae8a316b77c449ed45bdbf935ae3068caa6bcb3d13a2b427589bb23b4d5b
SHA51253b444efef4c760aa247df7bfe7dad6354f991fffcbe036a2ee345e1c084c4d718abf68655b7682ffafd028e9ba4939f622bb0696664955d21b88e8693634d66
-
Filesize
371KB
MD509dacba42b1275cc4222fa06a0bcaebc
SHA1096e48620cfe79bda93914188fb17a8304e4a1bd
SHA2563d610fd3bd4b8f64552ede267dac658298c867a388b35306af44b04c18a7bd26
SHA5126d7038c16c928c471a13250671c57dce165aa216ec8fbc559613c0f052c87cdd866e3683471a79199aa0e9aa8605048c35f048201f0ab6b954f92742b98e0aed
-
Filesize
371KB
MD509dacba42b1275cc4222fa06a0bcaebc
SHA1096e48620cfe79bda93914188fb17a8304e4a1bd
SHA2563d610fd3bd4b8f64552ede267dac658298c867a388b35306af44b04c18a7bd26
SHA5126d7038c16c928c471a13250671c57dce165aa216ec8fbc559613c0f052c87cdd866e3683471a79199aa0e9aa8605048c35f048201f0ab6b954f92742b98e0aed
-
Filesize
371KB
MD52d59a31fb9e27dddb14201db6350a5ed
SHA106f3ee16d65efe277b80ee5c77a6a0d5238ee012
SHA2560214a544f5667d03a80b35784127eeafdf30af04caf00ce56ed332f68c1f08cf
SHA512fcd2fd500a6730b3b7f7be4c0ba6ab6f2b5770219cc4c25c5552f258a5315eb562dc4c01c5661a3db596538f1311940abbae28d69a4de1a201d8da4d6a9a5601
-
Filesize
371KB
MD52d59a31fb9e27dddb14201db6350a5ed
SHA106f3ee16d65efe277b80ee5c77a6a0d5238ee012
SHA2560214a544f5667d03a80b35784127eeafdf30af04caf00ce56ed332f68c1f08cf
SHA512fcd2fd500a6730b3b7f7be4c0ba6ab6f2b5770219cc4c25c5552f258a5315eb562dc4c01c5661a3db596538f1311940abbae28d69a4de1a201d8da4d6a9a5601
-
Filesize
371KB
MD559f52e25f365c2e45e4347469d633ad3
SHA1f616db1a2586a2ee4922006c3f37ac1d3fb64373
SHA25601a0d85a3da658f4551bd89a6d56bec6f2e4f96352ee7e6d9f1b268d481c76e9
SHA512efec111d9f9ec94be9fde389e8ace1371f8c9cdcd65eb01c658646c82e838cc3ba7dfe527991975681c73b537709fe8b61c3b315346cd8d372abe263f72481ca
-
Filesize
371KB
MD559f52e25f365c2e45e4347469d633ad3
SHA1f616db1a2586a2ee4922006c3f37ac1d3fb64373
SHA25601a0d85a3da658f4551bd89a6d56bec6f2e4f96352ee7e6d9f1b268d481c76e9
SHA512efec111d9f9ec94be9fde389e8ace1371f8c9cdcd65eb01c658646c82e838cc3ba7dfe527991975681c73b537709fe8b61c3b315346cd8d372abe263f72481ca
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
85KB
MD5c35543925ed68ecfa3c6729a1f09c415
SHA1765980b0864b752d857347cdf217253128a2bfcb
SHA256e6594881840c83f2f6fe4931f7b2a739573d210ce2e47f73febfec2b2b952c21
SHA512994a0911ee9857be0e3d7b4cd46bd22f5976cca5a9994c06b96ea2a3f7c55a3cb15e0d6ff1692eb15d4c78ce95e174287b23de1873413364deee7663b1cdf439
-
Filesize
371KB
MD57bbdd38a87f9ad2409cd3b5271a92121
SHA164ce5c8ceef1b29ec71caec228228f88368968ec
SHA25663b1ee858a64c48ccd33086ce824db3a6582dd1eb69a4c5dc12033a6cbb87561
SHA512c3f85e1e15753e814fa31c933d034d5e83d2059fda026054680158123538d330011417307475cac8bc57a6430520599c18d2617f208a2e3bca539f929fee205b
-
Filesize
371KB
MD57bbdd38a87f9ad2409cd3b5271a92121
SHA164ce5c8ceef1b29ec71caec228228f88368968ec
SHA25663b1ee858a64c48ccd33086ce824db3a6582dd1eb69a4c5dc12033a6cbb87561
SHA512c3f85e1e15753e814fa31c933d034d5e83d2059fda026054680158123538d330011417307475cac8bc57a6430520599c18d2617f208a2e3bca539f929fee205b
-
Filesize
371KB
MD57ae8024a42d561433ed6f7dc3faef1c5
SHA1c0be8b31ba09051fe61b8b7bfe018bf28d4d32ad
SHA2563d85155ccc3f3ca9c0748366629a1c01732cf035e43131fbb70ca33fe11b059a
SHA5121aca8fb73841f85286e8da4d43197e0b15f3c3badde6b733520c0fb2bd12b9ceb8b7df344ad0858eea1edafb03547fbaed4c001759f25b501961f7f5881f64f6
-
Filesize
371KB
MD57ae8024a42d561433ed6f7dc3faef1c5
SHA1c0be8b31ba09051fe61b8b7bfe018bf28d4d32ad
SHA2563d85155ccc3f3ca9c0748366629a1c01732cf035e43131fbb70ca33fe11b059a
SHA5121aca8fb73841f85286e8da4d43197e0b15f3c3badde6b733520c0fb2bd12b9ceb8b7df344ad0858eea1edafb03547fbaed4c001759f25b501961f7f5881f64f6
-
Filesize
371KB
MD547c522c313242a20501b1c0b3312fe77
SHA11cb1ff05ca865496fbb54919233c17665e7f76e5
SHA25685addb503ea360a87e105a076e697fc7be63383573b9a81a607bb936052f3b58
SHA512c9793ede92e138706b5131ddba3b6680b9a8364e6b34568cf759e84226cf813d9857959a5d7995cdced03077d74b3cb5cbdd21cfc83567c9f4a62e4115d95297
-
Filesize
371KB
MD547c522c313242a20501b1c0b3312fe77
SHA11cb1ff05ca865496fbb54919233c17665e7f76e5
SHA25685addb503ea360a87e105a076e697fc7be63383573b9a81a607bb936052f3b58
SHA512c9793ede92e138706b5131ddba3b6680b9a8364e6b34568cf759e84226cf813d9857959a5d7995cdced03077d74b3cb5cbdd21cfc83567c9f4a62e4115d95297
-
Filesize
371KB
MD54f80d694b0d65c2b1078f5d31ca5ec29
SHA1cc6f76f1dd652a9bbb8056d68f8fed0f21f29585
SHA256dfdf6a4294955e029c43f40dc55fd233fc822a2af3f3e3d6bb51e255b3a51015
SHA5127e67acacb5a5c3c6a29493f06f7cd33210895554f1a7bc4a988839a2ddf0f888e8467a786222d31cc7c4297dc2be6267090e22c3b3f991db4a3aea9f4985fd12
-
Filesize
371KB
MD54f80d694b0d65c2b1078f5d31ca5ec29
SHA1cc6f76f1dd652a9bbb8056d68f8fed0f21f29585
SHA256dfdf6a4294955e029c43f40dc55fd233fc822a2af3f3e3d6bb51e255b3a51015
SHA5127e67acacb5a5c3c6a29493f06f7cd33210895554f1a7bc4a988839a2ddf0f888e8467a786222d31cc7c4297dc2be6267090e22c3b3f991db4a3aea9f4985fd12
-
Filesize
371KB
MD5775b590199e947e9e8b1fc6729cf8363
SHA17339f2cd8c01d752bc968bad3c2ee448ebc73639
SHA2562b46b4d947e11b6be4cee20937d19573039f8a16075cdbb43d5ed26eaff1a9c1
SHA5121d4c5ed60340d827e0aec4c8f070b67a046f50c12ba878b67e6af9dc88c24080069c02d86a07a90c2c50c94de0d40ab4e0f364c31ceb58d1e0d2966d0294e840
-
Filesize
371KB
MD5775b590199e947e9e8b1fc6729cf8363
SHA17339f2cd8c01d752bc968bad3c2ee448ebc73639
SHA2562b46b4d947e11b6be4cee20937d19573039f8a16075cdbb43d5ed26eaff1a9c1
SHA5121d4c5ed60340d827e0aec4c8f070b67a046f50c12ba878b67e6af9dc88c24080069c02d86a07a90c2c50c94de0d40ab4e0f364c31ceb58d1e0d2966d0294e840
-
Filesize
371KB
MD529c11aec013e71451089c6c0fbdbbd87
SHA1a1f8a5581a148fef160aa82bf5b2e9929210e18e
SHA25657e5483f89ffeb3972829ba6f677d13b408ec30d639ff769aeeb4c9a523b9e2b
SHA51227f4c0130c6c55337d8788faed1bfc84539d950eb398cbf889d2668f76c77b3103dacb148224d8e262d6d6d9d9c3f165f79acc469d8443903af522ffa1401bbb
-
Filesize
371KB
MD529c11aec013e71451089c6c0fbdbbd87
SHA1a1f8a5581a148fef160aa82bf5b2e9929210e18e
SHA25657e5483f89ffeb3972829ba6f677d13b408ec30d639ff769aeeb4c9a523b9e2b
SHA51227f4c0130c6c55337d8788faed1bfc84539d950eb398cbf889d2668f76c77b3103dacb148224d8e262d6d6d9d9c3f165f79acc469d8443903af522ffa1401bbb
-
Filesize
371KB
MD592aabc2dec9534a07f6d8280421bcc50
SHA12a73fc3e9cf54f58af35c99b0c26c974f9621f39
SHA2560e6585318affc42508228692f17d2d0c721379ff7023c285deea7120e705c1aa
SHA5125d46da5c46ac6b174d29f641e0c6aeaec904f2c9b54944957dded814cd6f059337ab058223c71ba1cfa7f620e7eee96e46d127f54f489f5b3ff95b1b12870411
-
Filesize
371KB
MD592aabc2dec9534a07f6d8280421bcc50
SHA12a73fc3e9cf54f58af35c99b0c26c974f9621f39
SHA2560e6585318affc42508228692f17d2d0c721379ff7023c285deea7120e705c1aa
SHA5125d46da5c46ac6b174d29f641e0c6aeaec904f2c9b54944957dded814cd6f059337ab058223c71ba1cfa7f620e7eee96e46d127f54f489f5b3ff95b1b12870411
-
Filesize
371KB
MD574a5e72835ee125b68f748310bf767f6
SHA1dfa8e71380bed7c04e8674fb4673dcc94f0a8377
SHA2568f67ae8a316b77c449ed45bdbf935ae3068caa6bcb3d13a2b427589bb23b4d5b
SHA51253b444efef4c760aa247df7bfe7dad6354f991fffcbe036a2ee345e1c084c4d718abf68655b7682ffafd028e9ba4939f622bb0696664955d21b88e8693634d66
-
Filesize
371KB
MD574a5e72835ee125b68f748310bf767f6
SHA1dfa8e71380bed7c04e8674fb4673dcc94f0a8377
SHA2568f67ae8a316b77c449ed45bdbf935ae3068caa6bcb3d13a2b427589bb23b4d5b
SHA51253b444efef4c760aa247df7bfe7dad6354f991fffcbe036a2ee345e1c084c4d718abf68655b7682ffafd028e9ba4939f622bb0696664955d21b88e8693634d66
-
Filesize
371KB
MD574a5e72835ee125b68f748310bf767f6
SHA1dfa8e71380bed7c04e8674fb4673dcc94f0a8377
SHA2568f67ae8a316b77c449ed45bdbf935ae3068caa6bcb3d13a2b427589bb23b4d5b
SHA51253b444efef4c760aa247df7bfe7dad6354f991fffcbe036a2ee345e1c084c4d718abf68655b7682ffafd028e9ba4939f622bb0696664955d21b88e8693634d66
-
Filesize
371KB
MD509dacba42b1275cc4222fa06a0bcaebc
SHA1096e48620cfe79bda93914188fb17a8304e4a1bd
SHA2563d610fd3bd4b8f64552ede267dac658298c867a388b35306af44b04c18a7bd26
SHA5126d7038c16c928c471a13250671c57dce165aa216ec8fbc559613c0f052c87cdd866e3683471a79199aa0e9aa8605048c35f048201f0ab6b954f92742b98e0aed
-
Filesize
371KB
MD509dacba42b1275cc4222fa06a0bcaebc
SHA1096e48620cfe79bda93914188fb17a8304e4a1bd
SHA2563d610fd3bd4b8f64552ede267dac658298c867a388b35306af44b04c18a7bd26
SHA5126d7038c16c928c471a13250671c57dce165aa216ec8fbc559613c0f052c87cdd866e3683471a79199aa0e9aa8605048c35f048201f0ab6b954f92742b98e0aed
-
Filesize
371KB
MD509dacba42b1275cc4222fa06a0bcaebc
SHA1096e48620cfe79bda93914188fb17a8304e4a1bd
SHA2563d610fd3bd4b8f64552ede267dac658298c867a388b35306af44b04c18a7bd26
SHA5126d7038c16c928c471a13250671c57dce165aa216ec8fbc559613c0f052c87cdd866e3683471a79199aa0e9aa8605048c35f048201f0ab6b954f92742b98e0aed
-
Filesize
371KB
MD509dacba42b1275cc4222fa06a0bcaebc
SHA1096e48620cfe79bda93914188fb17a8304e4a1bd
SHA2563d610fd3bd4b8f64552ede267dac658298c867a388b35306af44b04c18a7bd26
SHA5126d7038c16c928c471a13250671c57dce165aa216ec8fbc559613c0f052c87cdd866e3683471a79199aa0e9aa8605048c35f048201f0ab6b954f92742b98e0aed
-
Filesize
371KB
MD52d59a31fb9e27dddb14201db6350a5ed
SHA106f3ee16d65efe277b80ee5c77a6a0d5238ee012
SHA2560214a544f5667d03a80b35784127eeafdf30af04caf00ce56ed332f68c1f08cf
SHA512fcd2fd500a6730b3b7f7be4c0ba6ab6f2b5770219cc4c25c5552f258a5315eb562dc4c01c5661a3db596538f1311940abbae28d69a4de1a201d8da4d6a9a5601
-
Filesize
371KB
MD52d59a31fb9e27dddb14201db6350a5ed
SHA106f3ee16d65efe277b80ee5c77a6a0d5238ee012
SHA2560214a544f5667d03a80b35784127eeafdf30af04caf00ce56ed332f68c1f08cf
SHA512fcd2fd500a6730b3b7f7be4c0ba6ab6f2b5770219cc4c25c5552f258a5315eb562dc4c01c5661a3db596538f1311940abbae28d69a4de1a201d8da4d6a9a5601
-
Filesize
371KB
MD559f52e25f365c2e45e4347469d633ad3
SHA1f616db1a2586a2ee4922006c3f37ac1d3fb64373
SHA25601a0d85a3da658f4551bd89a6d56bec6f2e4f96352ee7e6d9f1b268d481c76e9
SHA512efec111d9f9ec94be9fde389e8ace1371f8c9cdcd65eb01c658646c82e838cc3ba7dfe527991975681c73b537709fe8b61c3b315346cd8d372abe263f72481ca
-
Filesize
371KB
MD559f52e25f365c2e45e4347469d633ad3
SHA1f616db1a2586a2ee4922006c3f37ac1d3fb64373
SHA25601a0d85a3da658f4551bd89a6d56bec6f2e4f96352ee7e6d9f1b268d481c76e9
SHA512efec111d9f9ec94be9fde389e8ace1371f8c9cdcd65eb01c658646c82e838cc3ba7dfe527991975681c73b537709fe8b61c3b315346cd8d372abe263f72481ca
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD5485ccb751dcd9371d05dbbd4a6025638
SHA1bb183d48cebcdd0ed5322f99e867a0e380fc4976
SHA256b8b44c7e9fbcc3ed90c9dd63ae0148f9cf6023573d6657fc8c6a9834abcfdcce
SHA51223a831c667967af7bd0fb8e43862b70fa32bd73a1affa018af62086d763c321803da29350f50baee5fd2b864a3b60427b0d88303e1325226f0085f6adc4c3cb4
-
Filesize
371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d
-
Filesize
371KB
MD535e17211f380bc17786b036786a3768c
SHA10453551feb4798758599d95de4c1b9b1a4741e42
SHA256a4fd39dfd97af474095c1c0073ee2161c776210c1d931cf421f4f03bed6ce17f
SHA512c3c4c972655141f90f41ab1b0df7a66b4768ee79c76556c57d48ddec7ac7836effbf41ef7357d3b82ef32533c98ad5e4dfb615403459796fadfab94de37a5f5d