Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 19:59
Behavioral task
behavioral1
Sample
4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe
Resource
win7-20240221-en
General
-
Target
4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe
-
Size
434KB
-
MD5
e658b241a16eac92f1acc40d6d97e50e
-
SHA1
24a84e08ae777e19ecabb572ec357a83d7e10524
-
SHA256
4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018
-
SHA512
db11cd124f5f15782e7d12fb96e00326dc07513c5a5d80d0906144824eec9b06215fa206cd813acce21a20c0a50c5f11fcbc1e420598f76b99855f37898c850f
-
SSDEEP
3072:HmVwRKC+mVwRa4zVwGOzVw+63zVwtTbBzVwGOzVwhLmW:HmVnrmVN4zVOzi3zszVOz8LR
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe -
UPX dump on OEP (original entry point) 62 IoCs
resource yara_rule behavioral1/memory/1812-0-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x002d000000014665-5.dat UPX behavioral1/memory/2948-13-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1812-23-0x00000000025B0000-0x0000000002628000-memory.dmp UPX behavioral1/memory/2616-28-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2580-50-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1812-53-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2716-69-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2948-71-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1916-75-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x0006000000015cca-76.dat UPX behavioral1/memory/2532-83-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x0006000000015cdb-90.dat UPX behavioral1/memory/2984-97-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2444-99-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1812-107-0x00000000025B0000-0x0000000002628000-memory.dmp UPX behavioral1/memory/2824-123-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/3024-122-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x002d000000014701-139.dat UPX behavioral1/memory/2776-140-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x0006000000015d6e-148.dat UPX behavioral1/files/0x0006000000015f9e-159.dat UPX behavioral1/memory/2764-182-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1704-183-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x0007000000015f1b-195.dat UPX behavioral1/memory/2356-202-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/files/0x0006000000016411-207.dat UPX behavioral1/memory/2320-213-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2356-218-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2388-217-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1856-236-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2396-248-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1364-268-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2312-270-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1680-272-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1680-274-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2312-279-0x0000000002BF0000-0x0000000002C68000-memory.dmp UPX behavioral1/memory/2288-283-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1736-288-0x0000000002FC0000-0x0000000003038000-memory.dmp UPX behavioral1/memory/916-290-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/916-293-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/596-306-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/360-301-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1856-315-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/984-318-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1580-326-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1736-332-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1600-336-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2952-343-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/312-351-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2700-360-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2596-366-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2596-371-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2728-376-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1912-391-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2172-398-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2172-400-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2832-409-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2964-416-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/3012-425-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1560-434-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/2700-439-0x0000000000400000-0x0000000000478000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2948 backup.exe 2616 backup.exe 2532 backup.exe 2580 backup.exe 2716 update.exe 1916 backup.exe 2444 backup.exe 2984 backup.exe 2824 backup.exe 3024 backup.exe 2776 backup.exe 2320 backup.exe 2764 backup.exe 1704 backup.exe 2312 data.exe 2356 backup.exe 2388 backup.exe 596 backup.exe 1856 backup.exe 2396 data.exe 1736 backup.exe 1364 backup.exe 1680 backup.exe 2288 backup.exe 916 backup.exe 360 backup.exe 2292 backup.exe 984 backup.exe 1580 backup.exe 1600 backup.exe 2952 backup.exe 312 backup.exe 2700 backup.exe 2596 backup.exe 2728 update.exe 1912 backup.exe 2172 backup.exe 2832 backup.exe 2964 backup.exe 3012 backup.exe 1560 backup.exe 2768 backup.exe 2836 backup.exe 628 backup.exe 1244 backup.exe 2808 backup.exe 1240 backup.exe 2068 backup.exe 336 data.exe 584 data.exe 1852 backup.exe 1328 System Restore.exe 2264 backup.exe 1552 backup.exe 1828 backup.exe 568 backup.exe 1092 backup.exe 2260 backup.exe 984 backup.exe 1580 backup.exe 2944 backup.exe 2520 backup.exe 312 backup.exe 2748 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 2716 update.exe 2716 update.exe 2716 update.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 2444 backup.exe 2444 backup.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 2824 backup.exe 2824 backup.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 2320 backup.exe 2320 backup.exe 2764 backup.exe 2764 backup.exe 2320 backup.exe 2320 backup.exe 2312 data.exe 2312 data.exe 2356 backup.exe 2356 backup.exe 2312 data.exe 2312 data.exe 596 backup.exe 596 backup.exe 1856 backup.exe 1856 backup.exe 1856 backup.exe 1856 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe -
resource yara_rule behavioral1/memory/1812-0-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x002d000000014665-5.dat upx behavioral1/memory/2948-13-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1812-23-0x00000000025B0000-0x0000000002628000-memory.dmp upx behavioral1/memory/2616-28-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2580-50-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1812-53-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2716-69-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2948-71-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1916-75-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x0006000000015cca-76.dat upx behavioral1/memory/2532-83-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x0006000000015cdb-90.dat upx behavioral1/memory/2984-97-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2444-99-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1812-107-0x00000000025B0000-0x0000000002628000-memory.dmp upx behavioral1/memory/2824-123-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/3024-122-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x002d000000014701-139.dat upx behavioral1/memory/2776-140-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x0006000000015d6e-148.dat upx behavioral1/files/0x0006000000015f9e-159.dat upx behavioral1/memory/2764-182-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1704-183-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x0007000000015f1b-195.dat upx behavioral1/memory/2356-202-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x0006000000016411-207.dat upx behavioral1/memory/2320-213-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2356-218-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2388-217-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1856-236-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2396-248-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1736-260-0x0000000002FC0000-0x0000000003038000-memory.dmp upx behavioral1/memory/1364-268-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2312-270-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1680-272-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1680-274-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2312-279-0x0000000002BF0000-0x0000000002C68000-memory.dmp upx behavioral1/memory/2288-283-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1736-288-0x0000000002FC0000-0x0000000003038000-memory.dmp upx behavioral1/memory/916-290-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/916-293-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/596-306-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/360-301-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1856-315-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/984-318-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1580-326-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1736-332-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1600-336-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2952-343-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/312-351-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2700-360-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2596-366-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2596-371-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2728-376-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1912-391-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2172-398-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2172-400-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2832-409-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2964-416-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2700-421-0x0000000002720000-0x0000000002798000-memory.dmp upx behavioral1/memory/3012-425-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1560-434-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2700-439-0x0000000000400000-0x0000000000478000-memory.dmp upx -
Drops file in Program Files directory 56 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 2948 backup.exe 2616 backup.exe 2532 backup.exe 2580 backup.exe 2716 update.exe 1916 backup.exe 2444 backup.exe 2984 backup.exe 2824 backup.exe 3024 backup.exe 2776 backup.exe 2320 backup.exe 2764 backup.exe 1704 backup.exe 2312 data.exe 2356 backup.exe 2388 backup.exe 596 backup.exe 1856 backup.exe 2396 data.exe 1736 backup.exe 1364 backup.exe 1680 backup.exe 2288 backup.exe 916 backup.exe 360 backup.exe 2292 backup.exe 984 backup.exe 1580 backup.exe 1600 backup.exe 2952 backup.exe 312 backup.exe 2700 backup.exe 2596 backup.exe 2728 update.exe 1912 backup.exe 2172 backup.exe 2832 backup.exe 2964 backup.exe 3012 backup.exe 1560 backup.exe 2768 backup.exe 2836 backup.exe 628 backup.exe 1244 backup.exe 2808 backup.exe 1240 backup.exe 2068 backup.exe 336 data.exe 584 data.exe 1852 backup.exe 1328 System Restore.exe 2264 backup.exe 1552 backup.exe 1828 backup.exe 568 backup.exe 1092 backup.exe 2260 backup.exe 984 backup.exe 1580 backup.exe 2944 backup.exe 2520 backup.exe 312 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2948 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 28 PID 1812 wrote to memory of 2948 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 28 PID 1812 wrote to memory of 2948 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 28 PID 1812 wrote to memory of 2948 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 28 PID 1812 wrote to memory of 2616 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 29 PID 1812 wrote to memory of 2616 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 29 PID 1812 wrote to memory of 2616 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 29 PID 1812 wrote to memory of 2616 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 29 PID 1812 wrote to memory of 2532 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 30 PID 1812 wrote to memory of 2532 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 30 PID 1812 wrote to memory of 2532 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 30 PID 1812 wrote to memory of 2532 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 30 PID 1812 wrote to memory of 2580 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 31 PID 1812 wrote to memory of 2580 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 31 PID 1812 wrote to memory of 2580 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 31 PID 1812 wrote to memory of 2580 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 31 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 2716 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 32 PID 1812 wrote to memory of 1916 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 33 PID 1812 wrote to memory of 1916 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 33 PID 1812 wrote to memory of 1916 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 33 PID 1812 wrote to memory of 1916 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 33 PID 1812 wrote to memory of 2444 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 34 PID 1812 wrote to memory of 2444 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 34 PID 1812 wrote to memory of 2444 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 34 PID 1812 wrote to memory of 2444 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 34 PID 2444 wrote to memory of 2984 2444 backup.exe 35 PID 2444 wrote to memory of 2984 2444 backup.exe 35 PID 2444 wrote to memory of 2984 2444 backup.exe 35 PID 2444 wrote to memory of 2984 2444 backup.exe 35 PID 1812 wrote to memory of 2824 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 36 PID 1812 wrote to memory of 2824 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 36 PID 1812 wrote to memory of 2824 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 36 PID 1812 wrote to memory of 2824 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 36 PID 2824 wrote to memory of 3024 2824 backup.exe 37 PID 2824 wrote to memory of 3024 2824 backup.exe 37 PID 2824 wrote to memory of 3024 2824 backup.exe 37 PID 2824 wrote to memory of 3024 2824 backup.exe 37 PID 1812 wrote to memory of 2776 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 38 PID 1812 wrote to memory of 2776 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 38 PID 1812 wrote to memory of 2776 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 38 PID 1812 wrote to memory of 2776 1812 4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe 38 PID 2948 wrote to memory of 2320 2948 backup.exe 39 PID 2948 wrote to memory of 2320 2948 backup.exe 39 PID 2948 wrote to memory of 2320 2948 backup.exe 39 PID 2948 wrote to memory of 2320 2948 backup.exe 39 PID 2320 wrote to memory of 2764 2320 backup.exe 40 PID 2320 wrote to memory of 2764 2320 backup.exe 40 PID 2320 wrote to memory of 2764 2320 backup.exe 40 PID 2320 wrote to memory of 2764 2320 backup.exe 40 PID 2764 wrote to memory of 1704 2764 backup.exe 41 PID 2764 wrote to memory of 1704 2764 backup.exe 41 PID 2764 wrote to memory of 1704 2764 backup.exe 41 PID 2764 wrote to memory of 1704 2764 backup.exe 41 PID 2320 wrote to memory of 2312 2320 backup.exe 42 PID 2320 wrote to memory of 2312 2320 backup.exe 42 PID 2320 wrote to memory of 2312 2320 backup.exe 42 PID 2320 wrote to memory of 2312 2320 backup.exe 42 PID 2312 wrote to memory of 2356 2312 data.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe"C:\Users\Admin\AppData\Local\Temp\4f80dd422b71e9fe8ee18011ce68e7fecd8cbc72ff87dfac7e58340b22bdd018.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1738458047\backup.exeC:\Users\Admin\AppData\Local\Temp\1738458047\backup.exe C:\Users\Admin\AppData\Local\Temp\1738458047\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2948 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2764 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
-
C:\Program Files\data.exe"C:\Program Files\data.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2356 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:596 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1856 -
C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1364
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:360
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:312
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2700 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2768
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1244
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2808
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1852
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2264
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1828
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2260
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:312
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵PID:1260
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:2780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:2916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:2276
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2460 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵PID:2752
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:2868
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:2216
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:2872
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:2984
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:2680
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:2832
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:2056
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:2920
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:2664
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2540
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1768
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:2776
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1752
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2484
-
-
C:\Program Files\Common Files\SpeechEngines\System Restore.exe"C:\Program Files\Common Files\SpeechEngines\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:3008
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\data.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\data.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵PID:3048
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵PID:2528
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:2980
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:2100
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1924
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵PID:2452
-
C:\Program Files\DVD Maker\de-DE\update.exe"C:\Program Files\DVD Maker\de-DE\update.exe" C:\Program Files\DVD Maker\de-DE\6⤵PID:1052
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1604
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:2440
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1400
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:448
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:2188
-
-
C:\Program Files\DVD Maker\Shared\System Restore.exe"C:\Program Files\DVD Maker\Shared\System Restore.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:2968
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:2612
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:360
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:1904
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1196
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:2592
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:2784
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:2380
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:2892
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:1560
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:1380
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1776
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:2812
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:324
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:2220
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1976
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1748
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2132
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:3052
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:1568
-
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\5⤵PID:536
-
-
C:\Program Files\Windows Journal\backup.exe"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\5⤵PID:2260
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:2748 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵PID:2976
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵PID:1396
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵PID:836
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵PID:592
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:2228
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1784
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1716
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:2860
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1740
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:576
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:2416
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:2008
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:568
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\5⤵PID:1084
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:2164
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1828
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:2156
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1692
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1616
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1200
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1608
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2572
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2464
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:988
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\backup.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\backup.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_203200448\CRX_INSTALL\3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2984
-
-
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\backup.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\CRX_INSTALL\backup.exeC:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_56525882\CRX_INSTALL\3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3024
-
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD540df67a09634f9d9ec630b75f4e5bce8
SHA100371ad1f045154f6d366126c6f97cfef2d49600
SHA25609180450bc6d02f25699d22bb7742d2c18b8e3bc0de88286f5bf5d7f6c8ef59f
SHA512feb1bad4efab5e1b728b9757ecbd48504557260d6ba8d5be2e23fae32d5986982213ec9dcec3c24121c0f9a37ae64cd7227b80b6e52f5b44994ee0f3af5b9ac2
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
434KB
MD5abc3a2ebb5e06c5c449c520747731b0e
SHA1edb170b485f3640e7f3f23b3ea2533aa359184db
SHA256e8cc48e7a15788f2f2807bb8d3e1aa43236a16253608b8a09efb2e056ea62b2c
SHA5123afce34d678f329161738d212b3993e05436cf7a2ea6bce66eab0f0ebf258365ce35dcdfd51a0d8e9f59356425053ff05c8acc5e015ea3158b99f4186f2a13c9
-
Filesize
434KB
MD5aebf8eae2212e7d80f623744cd1ee298
SHA193806fe2a41d29b2e76565e19446406670535e98
SHA25671f5bebcb42f110a6465d2d7d32d4419e8ebaf9015d4d941dc8c83d1587ba9e6
SHA512f76ca8246d90551025547c12d98f28389933597cb9024bcf70a410242cf6700c393d7bb302aeb8d56ce6987ac490e943b0323d7fa0df8561aa2c78cb3b140aa8
-
Filesize
434KB
MD54c1e567d4359c39f31a42695ba0b4c8a
SHA1d1fe1bfb106fffb23f2a069708fdbe6b37fdfb26
SHA2568b9fa3ef7ed616daf035b3bc2556d9848c27d497d63c6a7a5f65f4a7e70aa3cc
SHA51281ce9daec8cd298444b8012e5ea8b6c515fcddbc04172eb87ed5d210c760c22a9754d65f53d56cc7a076c04c1af8f887525e695949812457202b1bba6758ee37
-
Filesize
434KB
MD5a4fbad2ab84741f7cc0f14616c071b63
SHA12be281a8170dce4de9b63b878b05677973c1211a
SHA256836390917bf19282e72c5401c3069f1be372af9a264fb902a6706bd8a3df18ac
SHA512276f922dcb87fb0b2e550e199b1b8dbcb4cb7d3adc1e2d165dd3b154e631639dfe9b8be19fad30516bf58b9751812246d1996455d1ffec08c6dbcbf64ddeb44b
-
Filesize
434KB
MD55dbe5f099584e5d86bc9f7f94874fcbe
SHA126097aa57b7410c0e2dc4d3aef4cf9e9ad21cd36
SHA256205ece9f64c09e71a1e87ca3cd2f8a0a705e79349f5d47d5048103d1ef6ea2c9
SHA512be3a01f1d7516a0a913f06e2fa98ba6a9ca3d6ae5bc9aacc9257249976039e4102def3f9e6ce9c46c08391de355364982aee9eb776326fe091dca24e3551a1b8
-
Filesize
434KB
MD54487ec26764028d404b384804e58df3c
SHA1efe711beda75df60d7579e9d671502644c1278f1
SHA25674cf595ebb0814dde88bc2e6561cf9a8ce8a23295fdbfc7c330d835e20a9f204
SHA512132feb4a8fc9bde1c0d36343a2e7c74aec25dc68e8c572fadc1b550fd18bae30425dd5fd4787c964478a66eeeeda4801e9bce413f5f5f71999b134cdd8269758
-
Filesize
434KB
MD5bd3123bd74af38dc771117cc4f8111ca
SHA10aaeccce0bb1c08f8a427d89ca46f7b3c6ba61cf
SHA256591ac5d5cbf1963850f26b6451ce31b3b8752a68fbb0e8074d532e203b986956
SHA512fb514964141b678c7320643a1239a7eac9ee9cfc05fb47ccc33bc1801556fc71731c078061e1c37fd25f19c9f976a016e0c7602b2026ccc06bf5b5853f7be6b0
-
Filesize
434KB
MD56e3d6988d3d5d758eb3b5c8afded570a
SHA1e4ccabc9e62f36cab76350f3eaa8a33b54c57cb3
SHA2568e2a236790c9f707809a9a2249ea77c24d4a00d96d5d13b1d3c732f6fc1eb7bd
SHA512067a891660e7ee412bdc30550e602ad246edf833127dd7ab6198f438282aa12fae20ae55f6191e50c09777975eda71df8339006f00bc1091f420b17c859d7d8d