Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 01:26
Static task
static1
Behavioral task
behavioral1
Sample
43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe
Resource
win10v2004-20220901-en
General
-
Target
43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe
-
Size
72KB
-
MD5
02dfa0fe732ecee29bc5f941a7073a72
-
SHA1
42498df93dc3d4406e57e212e81c175dd8861e00
-
SHA256
43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec
-
SHA512
654be6cde3db51f6a14a4b2b3b9ef060f26fac9ba711f192177bacceeb350b8c933bfba92b3776394437f3989ee78a45add52bb073ead22c57c7cf644a288cd7
-
SSDEEP
768:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP3E:ieTce/U/hKYuKPU
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1704 update.exe 2012 backup.exe 1308 backup.exe 1232 backup.exe 1776 backup.exe 1796 backup.exe 1536 backup.exe 1844 backup.exe 1512 update.exe 1992 backup.exe 1924 backup.exe 1468 backup.exe 1152 backup.exe 108 backup.exe 1676 backup.exe 1580 backup.exe 1940 backup.exe 1648 backup.exe 844 backup.exe 1236 backup.exe 944 backup.exe 2024 backup.exe 912 backup.exe 1772 data.exe 1788 backup.exe 548 backup.exe 1212 backup.exe 1696 backup.exe 1852 backup.exe 652 backup.exe 2032 update.exe 268 backup.exe 2016 backup.exe 564 backup.exe 1452 backup.exe 1932 backup.exe 1628 backup.exe 996 backup.exe 1152 backup.exe 1664 backup.exe 1080 backup.exe 1088 backup.exe 1172 backup.exe 1576 backup.exe 976 backup.exe 1988 backup.exe 1352 System Restore.exe 380 backup.exe 1792 backup.exe 2020 backup.exe 972 System Restore.exe 588 backup.exe 288 backup.exe 2004 backup.exe 1928 backup.exe 1972 backup.exe 1700 backup.exe 1796 backup.exe 1104 backup.exe 1464 backup.exe 1404 backup.exe 640 update.exe 1452 backup.exe 1836 update.exe -
Loads dropped DLL 64 IoCs
pid Process 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1704 update.exe 1704 update.exe 1704 update.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1232 backup.exe 1232 backup.exe 1796 backup.exe 1796 backup.exe 1796 backup.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1796 backup.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1512 update.exe 1512 update.exe 1512 update.exe 1232 backup.exe 1232 backup.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1992 backup.exe 1992 backup.exe 1992 backup.exe 1992 backup.exe 1992 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1468 backup.exe 1152 backup.exe 1152 backup.exe 1152 backup.exe 1992 backup.exe 1992 backup.exe 108 backup.exe 108 backup.exe 108 backup.exe 108 backup.exe 108 backup.exe 1676 backup.exe 1676 backup.exe 1676 backup.exe 1676 backup.exe 1676 backup.exe 1580 backup.exe 1580 backup.exe 1580 backup.exe 1676 backup.exe 1676 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1648 backup.exe 1648 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files (x86)\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 1704 update.exe 2012 backup.exe 1308 backup.exe 1232 backup.exe 1776 backup.exe 1796 backup.exe 1536 backup.exe 1844 backup.exe 1512 update.exe 1924 backup.exe 1992 backup.exe 1468 backup.exe 1152 backup.exe 108 backup.exe 1676 backup.exe 1580 backup.exe 1940 backup.exe 1648 backup.exe 844 backup.exe 1236 backup.exe 944 backup.exe 2024 backup.exe 912 backup.exe 1772 data.exe 1788 backup.exe 548 backup.exe 1212 backup.exe 1696 backup.exe 1852 backup.exe 652 backup.exe 2032 update.exe 268 backup.exe 2016 backup.exe 564 backup.exe 1932 backup.exe 1452 backup.exe 1628 backup.exe 996 backup.exe 1152 backup.exe 1664 backup.exe 1088 backup.exe 1080 backup.exe 1172 backup.exe 1576 backup.exe 976 backup.exe 1988 backup.exe 1352 System Restore.exe 380 backup.exe 1792 backup.exe 972 System Restore.exe 2020 backup.exe 588 backup.exe 288 backup.exe 2004 backup.exe 1928 backup.exe 1972 backup.exe 1700 backup.exe 1104 backup.exe 1796 backup.exe 1464 backup.exe 1404 backup.exe 640 update.exe 1452 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 1704 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 26 PID 1708 wrote to memory of 2012 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 27 PID 1708 wrote to memory of 2012 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 27 PID 1708 wrote to memory of 2012 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 27 PID 1708 wrote to memory of 2012 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 27 PID 1708 wrote to memory of 1308 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 28 PID 1708 wrote to memory of 1308 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 28 PID 1708 wrote to memory of 1308 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 28 PID 1708 wrote to memory of 1308 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 28 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1704 wrote to memory of 1232 1704 update.exe 29 PID 1708 wrote to memory of 1776 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 30 PID 1708 wrote to memory of 1776 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 30 PID 1708 wrote to memory of 1776 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 30 PID 1708 wrote to memory of 1776 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 30 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1232 wrote to memory of 1796 1232 backup.exe 31 PID 1708 wrote to memory of 1536 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 32 PID 1708 wrote to memory of 1536 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 32 PID 1708 wrote to memory of 1536 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 32 PID 1708 wrote to memory of 1536 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 32 PID 1708 wrote to memory of 1844 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 34 PID 1708 wrote to memory of 1844 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 34 PID 1708 wrote to memory of 1844 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 34 PID 1708 wrote to memory of 1844 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 34 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1796 wrote to memory of 1512 1796 backup.exe 33 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1232 wrote to memory of 1992 1232 backup.exe 35 PID 1708 wrote to memory of 1924 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 36 PID 1708 wrote to memory of 1924 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 36 PID 1708 wrote to memory of 1924 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 36 PID 1708 wrote to memory of 1924 1708 43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe 36 PID 1992 wrote to memory of 1468 1992 backup.exe 37 PID 1992 wrote to memory of 1468 1992 backup.exe 37 PID 1992 wrote to memory of 1468 1992 backup.exe 37 PID 1992 wrote to memory of 1468 1992 backup.exe 37 PID 1992 wrote to memory of 1468 1992 backup.exe 37 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe"C:\Users\Admin\AppData\Local\Temp\43d151dcdd7fce4d4af45c0aa9822711fae4dfee43fdca61b2dbca553140ffec.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\525690446\update.exeC:\Users\Admin\AppData\Local\Temp\525690446\update.exe C:\Users\Admin\AppData\Local\Temp\525690446\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1232 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1796 -
C:\PerfLogs\Admin\update.exeC:\PerfLogs\Admin\update.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1512
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1992 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1152
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:108 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1676 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1940 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1236
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1852
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2016 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1452
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1452
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1576
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:380
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1608
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:2244
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1088 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:380
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Disables RegEdit via registry modification
PID:864
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1752
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1352 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1924
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:268
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:2108
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\data.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:2076
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:996 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1664
-
-
-
C:\Program Files\Common Files\System\System Restore.exe"C:\Program Files\Common Files\System\System Restore.exe" C:\Program Files\Common Files\System\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1464 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:2044
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1448
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:2012
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:380
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1768
-
-
C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe"C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1144
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:920
-
-
C:\Program Files\Common Files\System\en-US\update.exe"C:\Program Files\Common Files\System\en-US\update.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:916
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:988
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1656
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:568
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1152 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1172
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1792
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:288
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1404
-
-
C:\Program Files\DVD Maker\Shared\update.exe"C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:640 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:976 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1540
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:584
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1840
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1860
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1368
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1928
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:652
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1932
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1452
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1280
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1684
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:2020
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:588
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1100
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1648
-
-
C:\Program Files\Microsoft Office\data.exe"C:\Program Files\Microsoft Office\data.exe" C:\Program Files\Microsoft Office\5⤵PID:1984
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2148
-
-
-
C:\Program Files (x86)\data.exe"C:\Program Files (x86)\data.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1772 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1212 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:564 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1628
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1796 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1836
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1176
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1064 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:1240
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1060
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:940
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1636
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:1544
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1384
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:916
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:288
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1352
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2172
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1080
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:616
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1104
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\data.exe"C:\Program Files (x86)\Common Files\Adobe AIR\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1076
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵PID:1064
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1856
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1808
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1492
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe"C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2276
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:468
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1508
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:984
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1908
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:2124
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1604
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:1972
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:2236
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:556
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵PID:1996
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\data.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\data.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2140
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1316
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1700
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:1788
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1664
-
-
C:\Users\Admin\Documents\data.exeC:\Users\Admin\Documents\data.exe C:\Users\Admin\Documents\6⤵PID:1504
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1624
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2268
-
-
-
C:\Users\Public\data.exeC:\Users\Public\data.exe C:\Users\Public\5⤵PID:1948
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1864
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:2132
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1920
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1776
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5de6332e6c4d1f7db1fe51583bb9f779f
SHA1dc4a72c6747283bba3d59898ab9531230dd83254
SHA2568af027e99fa04eed17f652262043a202e5c4b991848e11af5306490012f974c2
SHA512a86a208edc5acb822317105061cb02faf193bf41e35e512b237dbeaad00e97f3ffe4a49d071a306d593ef1e06cc9b6509f4aa3a37219396c425b11f5c5bb1554
-
Filesize
72KB
MD5de6332e6c4d1f7db1fe51583bb9f779f
SHA1dc4a72c6747283bba3d59898ab9531230dd83254
SHA2568af027e99fa04eed17f652262043a202e5c4b991848e11af5306490012f974c2
SHA512a86a208edc5acb822317105061cb02faf193bf41e35e512b237dbeaad00e97f3ffe4a49d071a306d593ef1e06cc9b6509f4aa3a37219396c425b11f5c5bb1554
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5c5456e04c72acc4f8627d7bb67512826
SHA1a8b9f6ab19445bf58a9bdb3ce2656a6291bae1cf
SHA25634b4d383d328ff6aafc60fbf5a31fd677677ee0ffcccdc1e95e2d47048717e3e
SHA512056de224c300089db5cc30d948e4e13a33cc036f4e67752aefb7da2e01ba78d095712321c5e329a45807444aedea54ae7f72427deee08b197dab7fb744bbcd83
-
Filesize
72KB
MD5c5456e04c72acc4f8627d7bb67512826
SHA1a8b9f6ab19445bf58a9bdb3ce2656a6291bae1cf
SHA25634b4d383d328ff6aafc60fbf5a31fd677677ee0ffcccdc1e95e2d47048717e3e
SHA512056de224c300089db5cc30d948e4e13a33cc036f4e67752aefb7da2e01ba78d095712321c5e329a45807444aedea54ae7f72427deee08b197dab7fb744bbcd83
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD5768c83e373820f49fb8acef1757a9197
SHA1b5f3ca3611902153cf8da362134ca5c5ed7fc581
SHA256b065e071b2ea2f769d13f31e498a1c0b55bd083a218a9cea0f1dbd0e677f5b2a
SHA5125ac6ccb4f285f25c9d5a3a29f744bfca1f7727669a7aebe3c445868a499def83fc7e79da28c75edd689e4eb911ebd2b76f77de1f60aff84450499a2bb46511f8
-
Filesize
72KB
MD5768c83e373820f49fb8acef1757a9197
SHA1b5f3ca3611902153cf8da362134ca5c5ed7fc581
SHA256b065e071b2ea2f769d13f31e498a1c0b55bd083a218a9cea0f1dbd0e677f5b2a
SHA5125ac6ccb4f285f25c9d5a3a29f744bfca1f7727669a7aebe3c445868a499def83fc7e79da28c75edd689e4eb911ebd2b76f77de1f60aff84450499a2bb46511f8
-
Filesize
72KB
MD5dfb35d88f7a43a9f77b8d86d1e365153
SHA196fb419285a2fb20e642ce66110ae796ff6110ec
SHA2565bf826c27b79c755fc6228c98380db96643d79eaa04eedeeeaa350dfbd3b9d2c
SHA51216200bbf2b01d2c5f4376702385097ee05bab88addd084c104b9cdf66392ea786ffb37ff6cef38c90a68e41784dff99fb2fe62755ae52e6115956557568c80c3
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5dfb35d88f7a43a9f77b8d86d1e365153
SHA196fb419285a2fb20e642ce66110ae796ff6110ec
SHA2565bf826c27b79c755fc6228c98380db96643d79eaa04eedeeeaa350dfbd3b9d2c
SHA51216200bbf2b01d2c5f4376702385097ee05bab88addd084c104b9cdf66392ea786ffb37ff6cef38c90a68e41784dff99fb2fe62755ae52e6115956557568c80c3
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5482e25832c6c79570ec5a22dcea7618a
SHA1f93f7c9b57fe0dab3dbe898dc9a5538c0616fe12
SHA256e75920499bcd8865b4e04e4dadbfd11546cbbdcc50c61e38210683fd0af46fab
SHA5121f8cd63bb2f2c275ed02030fe51c70d3d616d63c2d4561213d5d0cf750e7ebc67c8b7f1ab8e00b84ef109c006de7f5fc775fd9bba26f08df1c739afbd781f687
-
Filesize
72KB
MD5d70f6a849bc7beacb88fa486e4516de4
SHA1473ccce5dfd3432fcbf0e2170bade7d7db9c41f7
SHA256b31ca29df432db7b6646190816f21f7dc24d4273dfe4642f2ba0d1a500920a34
SHA51208c8c9b9e27ab19f29f7e63e8e3b557aa1d9fea75d9312a2c90bd04068f213420f09e6acabb9e82427f309f39eb20fe89289311264cd03fe7d87cad3253ab9d6
-
Filesize
72KB
MD53df27771882af2b715e24d78ef603194
SHA15ba65dc39ec8b5fb9a5138261e1232d346b71b58
SHA256037cd72af16145fb5502f70edbef8cd36a24df54a7c750b4a097ab084bef57c1
SHA512d12426405c15df067ac54a931227b8c490a7f6a0796ba3a946ee61525f3ae0c69d84802b5fa1889e5f774a1e746e58f9691f1c62e47ca98f5256c2212fc7b464
-
Filesize
72KB
MD519d29067f9ca2082534c0e4d59cc7bec
SHA16c83b153cf12b2a82eaecf2da2471fd47125821e
SHA25688adb7cbe488d6482e0acee2c4bda6be02754ac5a78bfe75ac1cf2f6f8d02fef
SHA51276462f9c305ba48e07e96b88440a8e89edd558a92fc3694a8496aa44f3c7bf55936154327491d214558762977061dd21419adbe2d08a68b7aa032756304024f5
-
Filesize
72KB
MD5b8cd5127461183bb8adab28b630f6fad
SHA14dc58872347bb2241a66d563b0161c75b3c71403
SHA25630da99b1b6a5a370c2980567f4a7cbda956944d5b7c58742f8ab31b22b7cce96
SHA5128109d7447713c1129a86d9c471cb05be063aa89d309bb8ad7c4e8ae88a4b11cec71f9802dececf520b03ea315bd35818f5fe9cee35dc24e66e064cb99bf0b767
-
Filesize
72KB
MD5b8cd5127461183bb8adab28b630f6fad
SHA14dc58872347bb2241a66d563b0161c75b3c71403
SHA25630da99b1b6a5a370c2980567f4a7cbda956944d5b7c58742f8ab31b22b7cce96
SHA5128109d7447713c1129a86d9c471cb05be063aa89d309bb8ad7c4e8ae88a4b11cec71f9802dececf520b03ea315bd35818f5fe9cee35dc24e66e064cb99bf0b767
-
Filesize
72KB
MD5de6332e6c4d1f7db1fe51583bb9f779f
SHA1dc4a72c6747283bba3d59898ab9531230dd83254
SHA2568af027e99fa04eed17f652262043a202e5c4b991848e11af5306490012f974c2
SHA512a86a208edc5acb822317105061cb02faf193bf41e35e512b237dbeaad00e97f3ffe4a49d071a306d593ef1e06cc9b6509f4aa3a37219396c425b11f5c5bb1554
-
Filesize
72KB
MD5de6332e6c4d1f7db1fe51583bb9f779f
SHA1dc4a72c6747283bba3d59898ab9531230dd83254
SHA2568af027e99fa04eed17f652262043a202e5c4b991848e11af5306490012f974c2
SHA512a86a208edc5acb822317105061cb02faf193bf41e35e512b237dbeaad00e97f3ffe4a49d071a306d593ef1e06cc9b6509f4aa3a37219396c425b11f5c5bb1554
-
Filesize
72KB
MD5de6332e6c4d1f7db1fe51583bb9f779f
SHA1dc4a72c6747283bba3d59898ab9531230dd83254
SHA2568af027e99fa04eed17f652262043a202e5c4b991848e11af5306490012f974c2
SHA512a86a208edc5acb822317105061cb02faf193bf41e35e512b237dbeaad00e97f3ffe4a49d071a306d593ef1e06cc9b6509f4aa3a37219396c425b11f5c5bb1554
-
Filesize
72KB
MD5de6332e6c4d1f7db1fe51583bb9f779f
SHA1dc4a72c6747283bba3d59898ab9531230dd83254
SHA2568af027e99fa04eed17f652262043a202e5c4b991848e11af5306490012f974c2
SHA512a86a208edc5acb822317105061cb02faf193bf41e35e512b237dbeaad00e97f3ffe4a49d071a306d593ef1e06cc9b6509f4aa3a37219396c425b11f5c5bb1554
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD52eceafb607766ffd4b3e21e5c00d92b6
SHA1e4f7d99c440a40140730ef76d3969632647ddf15
SHA256fc19b27102d79eb3158437972840f74a57edd7a8ed87444e29e2f2e49a6c071f
SHA512c705ebe1fdf66ca1203103557cec9b4d83cfad6e1c7b8e1aa26055c77821acaf53b4eb1aeb2c13bbe03f5149e2e6fa64a21c85692d9888d2260b38f93d4501f2
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD524eb984f478af11438bafb1022338167
SHA1bd46875da280103776c34953bb6a32e6d337f93c
SHA256b71c9bca783c160210e19abd7d08ea4cf47fd187f2f371bf35a5c34a8f335e1f
SHA51241662f366cd76d4c58dbea0ffa611078c8109d978ee086eb6e9d6e573008db57755c2a3d7a66fe0d7d4d58db438cd3243aced588cbc654564412ad2ff3ca7673
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5919acc66a8b3f85aa3fc50f0a6cf2c81
SHA1fbc3ac9de841a771db7c52c3b2629c39439eb3f9
SHA25692e52deb789109f13021d6de1f33d3ccd349bbd0a93869e07d255b574686ca3e
SHA512f6f8125fcd4830bb1010558cc93a7f1f23e3a7c53cb338df34b9d9b6a84e8e92d8645bddc0b5b2ab4a02001ce21dd9534d4e5437f061122494ec976a31c1b839
-
Filesize
72KB
MD5c5456e04c72acc4f8627d7bb67512826
SHA1a8b9f6ab19445bf58a9bdb3ce2656a6291bae1cf
SHA25634b4d383d328ff6aafc60fbf5a31fd677677ee0ffcccdc1e95e2d47048717e3e
SHA512056de224c300089db5cc30d948e4e13a33cc036f4e67752aefb7da2e01ba78d095712321c5e329a45807444aedea54ae7f72427deee08b197dab7fb744bbcd83
-
Filesize
72KB
MD5c5456e04c72acc4f8627d7bb67512826
SHA1a8b9f6ab19445bf58a9bdb3ce2656a6291bae1cf
SHA25634b4d383d328ff6aafc60fbf5a31fd677677ee0ffcccdc1e95e2d47048717e3e
SHA512056de224c300089db5cc30d948e4e13a33cc036f4e67752aefb7da2e01ba78d095712321c5e329a45807444aedea54ae7f72427deee08b197dab7fb744bbcd83
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD548979aa61e3b697c4ba45c9dd14cd3a1
SHA12ddca505d1856ea9513323cae224dc6277c5f922
SHA25686ea61a16d96c33dfac522edaf1c0e75d4d2e7a0f0faf2839f474d5c22472eb6
SHA512cec4ad6fd9f07f6b87c1bb7cb53b828fe713c6b0fe94b80a09159319672ac51bad9232d2b3b02fa8b340c3872e41445b6597bbd7781892e092293f0e9797c4c9
-
Filesize
72KB
MD5768c83e373820f49fb8acef1757a9197
SHA1b5f3ca3611902153cf8da362134ca5c5ed7fc581
SHA256b065e071b2ea2f769d13f31e498a1c0b55bd083a218a9cea0f1dbd0e677f5b2a
SHA5125ac6ccb4f285f25c9d5a3a29f744bfca1f7727669a7aebe3c445868a499def83fc7e79da28c75edd689e4eb911ebd2b76f77de1f60aff84450499a2bb46511f8
-
Filesize
72KB
MD5768c83e373820f49fb8acef1757a9197
SHA1b5f3ca3611902153cf8da362134ca5c5ed7fc581
SHA256b065e071b2ea2f769d13f31e498a1c0b55bd083a218a9cea0f1dbd0e677f5b2a
SHA5125ac6ccb4f285f25c9d5a3a29f744bfca1f7727669a7aebe3c445868a499def83fc7e79da28c75edd689e4eb911ebd2b76f77de1f60aff84450499a2bb46511f8
-
Filesize
72KB
MD5768c83e373820f49fb8acef1757a9197
SHA1b5f3ca3611902153cf8da362134ca5c5ed7fc581
SHA256b065e071b2ea2f769d13f31e498a1c0b55bd083a218a9cea0f1dbd0e677f5b2a
SHA5125ac6ccb4f285f25c9d5a3a29f744bfca1f7727669a7aebe3c445868a499def83fc7e79da28c75edd689e4eb911ebd2b76f77de1f60aff84450499a2bb46511f8
-
Filesize
72KB
MD5768c83e373820f49fb8acef1757a9197
SHA1b5f3ca3611902153cf8da362134ca5c5ed7fc581
SHA256b065e071b2ea2f769d13f31e498a1c0b55bd083a218a9cea0f1dbd0e677f5b2a
SHA5125ac6ccb4f285f25c9d5a3a29f744bfca1f7727669a7aebe3c445868a499def83fc7e79da28c75edd689e4eb911ebd2b76f77de1f60aff84450499a2bb46511f8
-
Filesize
72KB
MD5dfb35d88f7a43a9f77b8d86d1e365153
SHA196fb419285a2fb20e642ce66110ae796ff6110ec
SHA2565bf826c27b79c755fc6228c98380db96643d79eaa04eedeeeaa350dfbd3b9d2c
SHA51216200bbf2b01d2c5f4376702385097ee05bab88addd084c104b9cdf66392ea786ffb37ff6cef38c90a68e41784dff99fb2fe62755ae52e6115956557568c80c3
-
Filesize
72KB
MD5dfb35d88f7a43a9f77b8d86d1e365153
SHA196fb419285a2fb20e642ce66110ae796ff6110ec
SHA2565bf826c27b79c755fc6228c98380db96643d79eaa04eedeeeaa350dfbd3b9d2c
SHA51216200bbf2b01d2c5f4376702385097ee05bab88addd084c104b9cdf66392ea786ffb37ff6cef38c90a68e41784dff99fb2fe62755ae52e6115956557568c80c3
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5dfb35d88f7a43a9f77b8d86d1e365153
SHA196fb419285a2fb20e642ce66110ae796ff6110ec
SHA2565bf826c27b79c755fc6228c98380db96643d79eaa04eedeeeaa350dfbd3b9d2c
SHA51216200bbf2b01d2c5f4376702385097ee05bab88addd084c104b9cdf66392ea786ffb37ff6cef38c90a68e41784dff99fb2fe62755ae52e6115956557568c80c3
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5dfb35d88f7a43a9f77b8d86d1e365153
SHA196fb419285a2fb20e642ce66110ae796ff6110ec
SHA2565bf826c27b79c755fc6228c98380db96643d79eaa04eedeeeaa350dfbd3b9d2c
SHA51216200bbf2b01d2c5f4376702385097ee05bab88addd084c104b9cdf66392ea786ffb37ff6cef38c90a68e41784dff99fb2fe62755ae52e6115956557568c80c3
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5482e25832c6c79570ec5a22dcea7618a
SHA1f93f7c9b57fe0dab3dbe898dc9a5538c0616fe12
SHA256e75920499bcd8865b4e04e4dadbfd11546cbbdcc50c61e38210683fd0af46fab
SHA5121f8cd63bb2f2c275ed02030fe51c70d3d616d63c2d4561213d5d0cf750e7ebc67c8b7f1ab8e00b84ef109c006de7f5fc775fd9bba26f08df1c739afbd781f687
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5482e25832c6c79570ec5a22dcea7618a
SHA1f93f7c9b57fe0dab3dbe898dc9a5538c0616fe12
SHA256e75920499bcd8865b4e04e4dadbfd11546cbbdcc50c61e38210683fd0af46fab
SHA5121f8cd63bb2f2c275ed02030fe51c70d3d616d63c2d4561213d5d0cf750e7ebc67c8b7f1ab8e00b84ef109c006de7f5fc775fd9bba26f08df1c739afbd781f687
-
Filesize
72KB
MD5d70f6a849bc7beacb88fa486e4516de4
SHA1473ccce5dfd3432fcbf0e2170bade7d7db9c41f7
SHA256b31ca29df432db7b6646190816f21f7dc24d4273dfe4642f2ba0d1a500920a34
SHA51208c8c9b9e27ab19f29f7e63e8e3b557aa1d9fea75d9312a2c90bd04068f213420f09e6acabb9e82427f309f39eb20fe89289311264cd03fe7d87cad3253ab9d6
-
Filesize
72KB
MD5d70f6a849bc7beacb88fa486e4516de4
SHA1473ccce5dfd3432fcbf0e2170bade7d7db9c41f7
SHA256b31ca29df432db7b6646190816f21f7dc24d4273dfe4642f2ba0d1a500920a34
SHA51208c8c9b9e27ab19f29f7e63e8e3b557aa1d9fea75d9312a2c90bd04068f213420f09e6acabb9e82427f309f39eb20fe89289311264cd03fe7d87cad3253ab9d6
-
Filesize
72KB
MD53df27771882af2b715e24d78ef603194
SHA15ba65dc39ec8b5fb9a5138261e1232d346b71b58
SHA256037cd72af16145fb5502f70edbef8cd36a24df54a7c750b4a097ab084bef57c1
SHA512d12426405c15df067ac54a931227b8c490a7f6a0796ba3a946ee61525f3ae0c69d84802b5fa1889e5f774a1e746e58f9691f1c62e47ca98f5256c2212fc7b464
-
Filesize
72KB
MD53df27771882af2b715e24d78ef603194
SHA15ba65dc39ec8b5fb9a5138261e1232d346b71b58
SHA256037cd72af16145fb5502f70edbef8cd36a24df54a7c750b4a097ab084bef57c1
SHA512d12426405c15df067ac54a931227b8c490a7f6a0796ba3a946ee61525f3ae0c69d84802b5fa1889e5f774a1e746e58f9691f1c62e47ca98f5256c2212fc7b464
-
Filesize
72KB
MD519d29067f9ca2082534c0e4d59cc7bec
SHA16c83b153cf12b2a82eaecf2da2471fd47125821e
SHA25688adb7cbe488d6482e0acee2c4bda6be02754ac5a78bfe75ac1cf2f6f8d02fef
SHA51276462f9c305ba48e07e96b88440a8e89edd558a92fc3694a8496aa44f3c7bf55936154327491d214558762977061dd21419adbe2d08a68b7aa032756304024f5
-
Filesize
72KB
MD519d29067f9ca2082534c0e4d59cc7bec
SHA16c83b153cf12b2a82eaecf2da2471fd47125821e
SHA25688adb7cbe488d6482e0acee2c4bda6be02754ac5a78bfe75ac1cf2f6f8d02fef
SHA51276462f9c305ba48e07e96b88440a8e89edd558a92fc3694a8496aa44f3c7bf55936154327491d214558762977061dd21419adbe2d08a68b7aa032756304024f5