Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05/11/2023, 20:12
Behavioral task
behavioral1
Sample
NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe
Resource
win7-20231023-en
General
-
Target
NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe
-
Size
176KB
-
MD5
a7b5bf4b4557e6c904267d456d9e9b00
-
SHA1
31b0dd3e8874a87c2f2c9094310682310f8a5164
-
SHA256
1e4c0f81bafca73880fa3d54bd8517e8378bc8b7fe5f42f32446b2bbd744aef9
-
SHA512
3a6add4516795faeb682c455617a1ab9b676dc34f5482461ee9e8bc191a8ce2fe462ce3d9096d3ad208e475b526a2d33fc30b74ec30bacc9cf58858b74525cc2
-
SSDEEP
768:Ac/TbblFpQNwC3BEc4QEfu0Ei8XxNDI/vFaaz6JZ1Ssw63BEfU:x7bbl/eThavEjDUvFaaAXZL0U
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2376 backup.exe 2728 backup.exe 2488 backup.exe 2504 backup.exe 308 backup.exe 2976 data.exe 1580 System Restore.exe 2796 backup.exe 584 backup.exe 1040 backup.exe 1648 backup.exe 1144 backup.exe 640 backup.exe 1956 backup.exe 2320 backup.exe 2928 backup.exe 1668 backup.exe 1532 backup.exe 1356 backup.exe 1928 backup.exe 1044 backup.exe 328 update.exe 2328 data.exe 888 backup.exe 280 backup.exe 1068 backup.exe 1684 backup.exe 2620 backup.exe 2740 backup.exe 2688 backup.exe 2904 backup.exe 2644 backup.exe 2504 backup.exe 308 backup.exe 2992 backup.exe 1340 backup.exe 2752 backup.exe 2804 backup.exe 2868 backup.exe 1632 backup.exe 1672 backup.exe 1868 backup.exe 760 backup.exe 2860 backup.exe 2432 backup.exe 1884 backup.exe 1220 backup.exe 1904 backup.exe 2072 backup.exe 2384 backup.exe 2924 backup.exe 2064 backup.exe 240 backup.exe 1152 backup.exe 1740 backup.exe 844 System Restore.exe 2832 backup.exe 2132 backup.exe 560 backup.exe 3008 backup.exe 1784 update.exe 888 backup.exe 2768 backup.exe 1604 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 2796 backup.exe 2796 backup.exe 584 backup.exe 584 backup.exe 2796 backup.exe 2796 backup.exe 1648 backup.exe 1648 backup.exe 1144 backup.exe 1144 backup.exe 1648 backup.exe 1648 backup.exe 1956 backup.exe 1956 backup.exe 2320 backup.exe 2320 backup.exe 2320 backup.exe 2320 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 328 update.exe 328 update.exe 328 update.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 1668 backup.exe 2740 backup.exe 2740 backup.exe 2740 backup.exe 2740 backup.exe 2740 backup.exe 2740 backup.exe -
resource yara_rule behavioral1/memory/3036-0-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0026000000015e34-5.dat upx behavioral1/files/0x0026000000015e34-7.dat upx behavioral1/files/0x0026000000015e34-9.dat upx behavioral1/files/0x0026000000015e34-12.dat upx behavioral1/memory/2376-13-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0007000000016594-19.dat upx behavioral1/files/0x0007000000016594-17.dat upx behavioral1/files/0x0007000000016594-23.dat upx behavioral1/memory/3036-27-0x00000000002D0000-0x00000000002FC000-memory.dmp upx behavioral1/memory/2728-28-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2728-30-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0009000000016adb-31.dat upx behavioral1/files/0x0009000000016adb-33.dat upx behavioral1/files/0x0009000000016adb-37.dat upx behavioral1/files/0x0008000000016611-41.dat upx behavioral1/memory/3036-48-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0008000000016611-47.dat upx behavioral1/files/0x0008000000016611-43.dat upx behavioral1/files/0x0007000000016c9c-53.dat upx behavioral1/memory/2504-60-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0007000000016c9c-55.dat upx behavioral1/memory/2376-63-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0007000000016c9c-61.dat upx behavioral1/memory/308-66-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0009000000016c2e-67.dat upx behavioral1/files/0x0009000000016c2e-69.dat upx behavioral1/files/0x0009000000016c2e-73.dat upx behavioral1/memory/2976-77-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016cb7-78.dat upx behavioral1/files/0x0006000000016cb7-80.dat upx behavioral1/files/0x0006000000016cb7-85.dat upx behavioral1/memory/1580-88-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0026000000015e34-91.dat upx behavioral1/memory/2488-98-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016cd8-96.dat upx behavioral1/files/0x0006000000016cd8-103.dat upx behavioral1/files/0x0006000000016cec-105.dat upx behavioral1/files/0x0006000000016cec-112.dat upx behavioral1/files/0x0006000000016cec-107.dat upx behavioral1/files/0x0006000000016cec-115.dat upx behavioral1/files/0x0006000000016cfd-119.dat upx behavioral1/files/0x0006000000016cfd-117.dat upx behavioral1/files/0x0006000000016cfd-124.dat upx behavioral1/memory/1040-129-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/584-134-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1040-133-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0007000000016d04-137.dat upx behavioral1/files/0x0007000000016d04-141.dat upx behavioral1/files/0x0007000000016d04-135.dat upx behavioral1/files/0x0007000000016d04-145.dat upx behavioral1/files/0x0006000000016d20-147.dat upx behavioral1/files/0x0006000000016d20-154.dat upx behavioral1/memory/2796-153-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016d20-149.dat upx behavioral1/memory/1144-170-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016d20-171.dat upx behavioral1/files/0x002a000000015ea7-173.dat upx behavioral1/memory/1144-181-0x0000000000330000-0x000000000035C000-memory.dmp upx behavioral1/files/0x002a000000015ea7-180.dat upx behavioral1/files/0x002a000000015ea7-175.dat upx behavioral1/memory/1144-185-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/640-186-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016d66-187.dat upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\update.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\Java\jre7\bin\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\Branding\update.exe backup.exe File opened for modification C:\Windows\Branding\ShellBrd\backup.exe update.exe File opened for modification C:\Windows\assembly\GAC\backup.exe backup.exe File opened for modification C:\Windows\Branding\Basebrd\backup.exe update.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\CSC\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\Custom\update.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\AppPatch64\backup.exe backup.exe File opened for modification C:\Windows\assembly\GAC_32\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 2376 backup.exe 2728 backup.exe 2488 backup.exe 2504 backup.exe 308 backup.exe 2976 data.exe 1580 System Restore.exe 2796 backup.exe 584 backup.exe 1040 backup.exe 1648 backup.exe 1144 backup.exe 640 backup.exe 1956 backup.exe 2320 backup.exe 2928 backup.exe 1668 backup.exe 1532 backup.exe 1356 backup.exe 1928 backup.exe 1044 backup.exe 328 update.exe 2328 data.exe 888 backup.exe 280 backup.exe 1068 backup.exe 1684 backup.exe 2620 backup.exe 2740 backup.exe 2688 backup.exe 2904 backup.exe 2644 backup.exe 2504 backup.exe 308 backup.exe 2992 backup.exe 1340 backup.exe 2752 backup.exe 2804 backup.exe 2868 backup.exe 1632 backup.exe 1672 backup.exe 1868 backup.exe 760 backup.exe 2860 backup.exe 2432 backup.exe 1884 backup.exe 1220 backup.exe 1904 backup.exe 2072 backup.exe 2384 backup.exe 2924 backup.exe 2064 backup.exe 240 backup.exe 1152 backup.exe 1740 backup.exe 844 System Restore.exe 2832 backup.exe 2132 backup.exe 560 backup.exe 3008 backup.exe 1784 update.exe 888 backup.exe 2768 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2376 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 27 PID 3036 wrote to memory of 2376 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 27 PID 3036 wrote to memory of 2376 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 27 PID 3036 wrote to memory of 2376 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 27 PID 3036 wrote to memory of 2728 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 28 PID 3036 wrote to memory of 2728 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 28 PID 3036 wrote to memory of 2728 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 28 PID 3036 wrote to memory of 2728 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 28 PID 3036 wrote to memory of 2488 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 29 PID 3036 wrote to memory of 2488 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 29 PID 3036 wrote to memory of 2488 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 29 PID 3036 wrote to memory of 2488 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 29 PID 3036 wrote to memory of 2504 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 30 PID 3036 wrote to memory of 2504 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 30 PID 3036 wrote to memory of 2504 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 30 PID 3036 wrote to memory of 2504 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 30 PID 3036 wrote to memory of 308 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 31 PID 3036 wrote to memory of 308 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 31 PID 3036 wrote to memory of 308 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 31 PID 3036 wrote to memory of 308 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 31 PID 3036 wrote to memory of 2976 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 32 PID 3036 wrote to memory of 2976 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 32 PID 3036 wrote to memory of 2976 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 32 PID 3036 wrote to memory of 2976 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 32 PID 3036 wrote to memory of 1580 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 33 PID 3036 wrote to memory of 1580 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 33 PID 3036 wrote to memory of 1580 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 33 PID 3036 wrote to memory of 1580 3036 NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe 33 PID 2376 wrote to memory of 2796 2376 backup.exe 34 PID 2376 wrote to memory of 2796 2376 backup.exe 34 PID 2376 wrote to memory of 2796 2376 backup.exe 34 PID 2376 wrote to memory of 2796 2376 backup.exe 34 PID 2796 wrote to memory of 584 2796 backup.exe 35 PID 2796 wrote to memory of 584 2796 backup.exe 35 PID 2796 wrote to memory of 584 2796 backup.exe 35 PID 2796 wrote to memory of 584 2796 backup.exe 35 PID 584 wrote to memory of 1040 584 backup.exe 36 PID 584 wrote to memory of 1040 584 backup.exe 36 PID 584 wrote to memory of 1040 584 backup.exe 36 PID 584 wrote to memory of 1040 584 backup.exe 36 PID 2796 wrote to memory of 1648 2796 backup.exe 37 PID 2796 wrote to memory of 1648 2796 backup.exe 37 PID 2796 wrote to memory of 1648 2796 backup.exe 37 PID 2796 wrote to memory of 1648 2796 backup.exe 37 PID 1648 wrote to memory of 1144 1648 backup.exe 38 PID 1648 wrote to memory of 1144 1648 backup.exe 38 PID 1648 wrote to memory of 1144 1648 backup.exe 38 PID 1648 wrote to memory of 1144 1648 backup.exe 38 PID 1144 wrote to memory of 640 1144 backup.exe 39 PID 1144 wrote to memory of 640 1144 backup.exe 39 PID 1144 wrote to memory of 640 1144 backup.exe 39 PID 1144 wrote to memory of 640 1144 backup.exe 39 PID 1648 wrote to memory of 1956 1648 backup.exe 40 PID 1648 wrote to memory of 1956 1648 backup.exe 40 PID 1648 wrote to memory of 1956 1648 backup.exe 40 PID 1648 wrote to memory of 1956 1648 backup.exe 40 PID 1956 wrote to memory of 2320 1956 backup.exe 41 PID 1956 wrote to memory of 2320 1956 backup.exe 41 PID 1956 wrote to memory of 2320 1956 backup.exe 41 PID 1956 wrote to memory of 2320 1956 backup.exe 41 PID 2320 wrote to memory of 2928 2320 backup.exe 42 PID 2320 wrote to memory of 2928 2320 backup.exe 42 PID 2320 wrote to memory of 2928 2320 backup.exe 42 PID 2320 wrote to memory of 2928 2320 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a7b5bf4b4557e6c904267d456d9e9b00.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3749694731\backup.exeC:\Users\Admin\AppData\Local\Temp\3749694731\backup.exe C:\Users\Admin\AppData\Local\Temp\3749694731\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2376 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1144 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1956 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1668 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1356
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:280
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2504
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1340
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1152
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:1604 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵PID:2724
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:2908
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
PID:3056
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:2616
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:2500
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- System policy modification
PID:2552
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- System policy modification
PID:2160 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- System policy modification
PID:2976
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:2752
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
- System policy modification
PID:2804 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1404
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:632
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1524
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:2436
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:880
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1756
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Drops file in Program Files directory
PID:1880 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:2268
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1356
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:476
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:1684
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2084
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2272
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- System policy modification
PID:2680 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- Modifies visibility of file extensions in Explorer
PID:2840 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:2600
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- System policy modification
PID:2860
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1544 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵PID:2192
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
- System policy modification
PID:2724 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1340 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:2036
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:2584
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1260
-
-
C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe"C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:992
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2636
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:2364
-
-
-
C:\Program Files\Common Files\System\de-DE\System Restore.exe"C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- System policy modification
PID:1952
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- System policy modification
PID:1608
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:592
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
PID:2784
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2740
-
-
C:\Program Files\Common Files\System\ja-JP\update.exe"C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1568
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2420
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:1676 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- System policy modification
PID:328
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- System policy modification
PID:2748
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1336
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:2244
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:2880
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:2040
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1620 -
C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1316
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
PID:1612 -
C:\Program Files\Google\Chrome\data.exe"C:\Program Files\Google\Chrome\data.exe" C:\Program Files\Google\Chrome\6⤵PID:1440
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2676 -
C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2084 -
C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\9⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\9⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\9⤵PID:2400
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:2720
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2304 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:2624
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:2888
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- System policy modification
PID:1864
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:2996
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:1904
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:560
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
PID:1236 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Drops file in Program Files directory
PID:2388 -
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:1172
-
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵PID:2352
-
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵
- Drops file in Program Files directory
PID:108 -
C:\Program Files\Java\jre7\bin\backup.exe"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\7⤵PID:940
-
-
C:\Program Files\Java\jre7\lib\backup.exe"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\7⤵PID:2720
-
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Drops file in Program Files directory
PID:2612 -
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2876 -
C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\7⤵PID:2248
-
-
C:\Program Files\Microsoft Games\Chess\en-US\backup.exe"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\7⤵PID:1752
-
-
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵PID:2624
-
-
C:\Program Files\Microsoft Games\Hearts\System Restore.exe"C:\Program Files\Microsoft Games\Hearts\System Restore.exe" C:\Program Files\Microsoft Games\Hearts\6⤵PID:2456
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1252
-
C:\Program Files\Microsoft Office\Office14\backup.exe"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\6⤵PID:932
-
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:704 -
C:\Program Files\Mozilla Firefox\browser\backup.exe"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\6⤵PID:2468
-
-
C:\Program Files\Mozilla Firefox\defaults\backup.exe"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\6⤵PID:2040
-
-
C:\Program Files\Mozilla Firefox\fonts\backup.exe"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\6⤵PID:2064
-
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:592
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:844
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
- System policy modification
PID:2408 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Drops file in Program Files directory
- System policy modification
PID:2044 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
PID:876 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2496
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2856 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2348
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:328
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:884
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1516
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1360 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:2292
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:364
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:3040
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1644
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:2752
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:2664
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1636 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
PID:2728 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
- System policy modification
PID:2776
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\update.exe"C:\Program Files (x86)\Common Files\Adobe\Help\update.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1260
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1564 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- System policy modification
PID:2916
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\update.exe"C:\Program Files (x86)\Common Files\DESIGNER\update.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2804
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2948
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2764
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:2064
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
PID:3012
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
- Modifies visibility of file extensions in Explorer
PID:1856
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1668
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2532 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
- System policy modification
PID:2252
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:564
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:2348
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:844
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵PID:1380
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:3008
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:2288
-
C:\Users\Admin\update.exeC:\Users\Admin\update.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
PID:1272 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
PID:2572
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1868
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2092
-
-
C:\Users\Admin\Downloads\System Restore.exe"C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\6⤵PID:2172
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1664
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2620
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
PID:1264 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:2032
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1892
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:2736
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1312 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:1720
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:920
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:2508 -
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\6⤵PID:2696
-
-
C:\Windows\AppPatch\Custom\update.exeC:\Windows\AppPatch\Custom\update.exe C:\Windows\AppPatch\Custom\6⤵PID:2748
-
-
C:\Windows\AppPatch\de-DE\backup.exeC:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\6⤵PID:1676
-
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵
- Drops file in Windows directory
- System policy modification
PID:1780 -
C:\Windows\assembly\GAC\backup.exeC:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\6⤵PID:1900
-
-
C:\Windows\assembly\GAC_32\backup.exeC:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\6⤵PID:1864
-
-
-
C:\Windows\Branding\update.exeC:\Windows\Branding\update.exe C:\Windows\Branding\5⤵
- Drops file in Windows directory
- System policy modification
PID:2344 -
C:\Windows\Branding\Basebrd\backup.exeC:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\6⤵PID:2144
-
-
C:\Windows\Branding\ShellBrd\backup.exeC:\Windows\Branding\ShellBrd\backup.exe C:\Windows\Branding\ShellBrd\6⤵PID:780
-
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:1768
-
-
C:\Windows\Cursors\update.exeC:\Windows\Cursors\update.exe C:\Windows\Cursors\5⤵PID:2280
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:308
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD56128f4ff7639b07d5f344c2e23011b81
SHA18988008618afc3a05efcdd940c6418c7d1ce4068
SHA2561209897ce93c14258e2a059d4599934f14d87bd4ea0d5e7a67578f3bb6919196
SHA5121c7b2fbd54103c5b65abdbb9bb451f2741f7ab7808a5244af4416cbaacdfe40400d576821e4ac54ae4b3116369dbb8c676bfd0cf48a9417b0cd22d32957214d9
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD5a87725c17d1bf68791f092780d56939a
SHA17a02fa89e6b845a185371b8f779dd7a980180b86
SHA256e15633cfa15128dcc2269fa82ddb77acbdb619949eadffb81c08f09becccb425
SHA512988d9b9c43b002ac3d5d851cb6985ed5c6d09be45cfd6b4d7415096374ed818b69f20363f9425792eda5c840f6d259ba324bc8b148b42a79411b7a4e7118fa96
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD5a87725c17d1bf68791f092780d56939a
SHA17a02fa89e6b845a185371b8f779dd7a980180b86
SHA256e15633cfa15128dcc2269fa82ddb77acbdb619949eadffb81c08f09becccb425
SHA512988d9b9c43b002ac3d5d851cb6985ed5c6d09be45cfd6b4d7415096374ed818b69f20363f9425792eda5c840f6d259ba324bc8b148b42a79411b7a4e7118fa96
-
Filesize
33KB
MD548e27c8d12507feb3020ed2825a67baf
SHA1cceb9d46ca795a9b293ce47d2f8fc42086fac81c
SHA256839d6084596d7161e09d8526b9e943464baa09ec40a872619f5a6f27fbf2dfaf
SHA5120a6351c698fad4615df1672625f3479b55878e96c9cbe17397437d04da9bbae1e9961e1d6141373fa4e2af2978938bc4a7ff03015def3ac72cab755d65a9d5cf
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
176KB
MD520adb79114b0552a29c47902c177596c
SHA1ed5bdf15f198a0def8247f82c13fd7e745d4a436
SHA256add81ea546b4e5ce464aface571849ba87b86bb730da6a6a91b60ce714e3d53a
SHA512169a9f6492014d92c2740a90c93a1d230287f85aaf48099882336bb5f71d4fc434877940b899b5c121d04df29b50fe25ec6b6297f068f08ce86c47f4904e4c1e
-
Filesize
176KB
MD520adb79114b0552a29c47902c177596c
SHA1ed5bdf15f198a0def8247f82c13fd7e745d4a436
SHA256add81ea546b4e5ce464aface571849ba87b86bb730da6a6a91b60ce714e3d53a
SHA512169a9f6492014d92c2740a90c93a1d230287f85aaf48099882336bb5f71d4fc434877940b899b5c121d04df29b50fe25ec6b6297f068f08ce86c47f4904e4c1e
-
Filesize
176KB
MD56128f4ff7639b07d5f344c2e23011b81
SHA18988008618afc3a05efcdd940c6418c7d1ce4068
SHA2561209897ce93c14258e2a059d4599934f14d87bd4ea0d5e7a67578f3bb6919196
SHA5121c7b2fbd54103c5b65abdbb9bb451f2741f7ab7808a5244af4416cbaacdfe40400d576821e4ac54ae4b3116369dbb8c676bfd0cf48a9417b0cd22d32957214d9
-
Filesize
176KB
MD56128f4ff7639b07d5f344c2e23011b81
SHA18988008618afc3a05efcdd940c6418c7d1ce4068
SHA2561209897ce93c14258e2a059d4599934f14d87bd4ea0d5e7a67578f3bb6919196
SHA5121c7b2fbd54103c5b65abdbb9bb451f2741f7ab7808a5244af4416cbaacdfe40400d576821e4ac54ae4b3116369dbb8c676bfd0cf48a9417b0cd22d32957214d9
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD58b1e0ba46a857d973eff8e79e5c4bf98
SHA158f21703ddfa03cc5c22ee059388969258d56683
SHA2568a786c7d9b4909d190d37b69ec15b9a5ea0d55f8f9046966f09ef54a2b7b92a0
SHA512d6f5397d405d26402eda7deae62cbe2a4e75f02c6a107a3e270facd9d87e562a7ba35ba41df028b8e4c4d65f763d195d16d8ef4d38c982215aadbd1de06514fb
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD50e125ddcd7552810b924d378124a2ca7
SHA1fd6299c49b34f66ba2b8fde68043ae3305ec893b
SHA256f93464d67b6457914d4e01ace1c5aeb754ade3eb7c790877d530337adc1a3a8d
SHA5121eed4ef5a2e2ae964d140efcaf19760a7ee04af76e27ddf6df200b56ac7c82092417d0561c12aab73e536304dbab315300e4eb83094f69147961ff256f055a26
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD5f7a929df70eb57f643160493588b93bc
SHA11da4e8c4b84412a19d65fdee88d1d3fc357b2b63
SHA2568592bb6903dfe550ebcf331012f16971ade6a6107ede23ba3ee66f3e446eef9d
SHA512797dd01c358e57f51edbd290cd970303c30770e0635d85dd533cdebe162aeba59929d9f759ab1d4503c9783bff20daadb7daa46332634c8ad5ed32abf61b89c5
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD5943f20a84b981160ee9712f8abde9102
SHA11ca28728038a2e2b27214d529ef370649ba5048f
SHA256a87acca6811356466be2067d47714def3f5e5cefae5fe857d302702d36954419
SHA51290d23fe390303a6710a6030a1549896a79c601c71e5dffae17239c5ef88e1aa3f5922fdff7e19a6fcb30c9ccab6bbabe2e7451fd74d39214d0c35d1162fc10b0
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD598d40673f4e77c398efe2b6e06d030b4
SHA1900db1df2ad985d47bed7ea459578abe19d0befe
SHA25668dbb635612daa99725dedd96da6c7d0d1ff799eb82aebd2ecfbf8fca514718f
SHA5128700242524cad5071eec799e4c0b4ca0bf908083b3aa5d08e3f97c23c34b6bd12b66b70da8fad5a7a574576e28741563effc5e2d545603f9accc51f3263f2bbf
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD5a87725c17d1bf68791f092780d56939a
SHA17a02fa89e6b845a185371b8f779dd7a980180b86
SHA256e15633cfa15128dcc2269fa82ddb77acbdb619949eadffb81c08f09becccb425
SHA512988d9b9c43b002ac3d5d851cb6985ed5c6d09be45cfd6b4d7415096374ed818b69f20363f9425792eda5c840f6d259ba324bc8b148b42a79411b7a4e7118fa96
-
Filesize
176KB
MD5a87725c17d1bf68791f092780d56939a
SHA17a02fa89e6b845a185371b8f779dd7a980180b86
SHA256e15633cfa15128dcc2269fa82ddb77acbdb619949eadffb81c08f09becccb425
SHA512988d9b9c43b002ac3d5d851cb6985ed5c6d09be45cfd6b4d7415096374ed818b69f20363f9425792eda5c840f6d259ba324bc8b148b42a79411b7a4e7118fa96
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD50292b0cc50fc1c429e462c13f629ab66
SHA1b790f0f0a23155774821ecab0c1120a436140836
SHA256a6da1a64dcaa3377c975dfeaf0746a561ab0301f560b09d4b104a28dafcbfcc3
SHA51225e2cebfaee090a8a474d5e6e924315e3d3baf8a27be1ec14713324939eb8af628501aee57b08eda872a555fb686db0cdcd55ae857261402123cf7b196f432a7
-
Filesize
176KB
MD5a87725c17d1bf68791f092780d56939a
SHA17a02fa89e6b845a185371b8f779dd7a980180b86
SHA256e15633cfa15128dcc2269fa82ddb77acbdb619949eadffb81c08f09becccb425
SHA512988d9b9c43b002ac3d5d851cb6985ed5c6d09be45cfd6b4d7415096374ed818b69f20363f9425792eda5c840f6d259ba324bc8b148b42a79411b7a4e7118fa96
-
Filesize
176KB
MD5a87725c17d1bf68791f092780d56939a
SHA17a02fa89e6b845a185371b8f779dd7a980180b86
SHA256e15633cfa15128dcc2269fa82ddb77acbdb619949eadffb81c08f09becccb425
SHA512988d9b9c43b002ac3d5d851cb6985ed5c6d09be45cfd6b4d7415096374ed818b69f20363f9425792eda5c840f6d259ba324bc8b148b42a79411b7a4e7118fa96