Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe
Resource
win10v2004-20220812-en
General
-
Target
a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe
-
Size
72KB
-
MD5
65350fa1f9a22b9195ccd3e44a1b721f
-
SHA1
418e11e7acb2674c0d418ad4c82a1ea33cc23aef
-
SHA256
a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47
-
SHA512
708e05c902a7f46e10f527b61e165ecd81d37e2b85a760d9d126280e25cb98e72c9d7b13e9f53c6447efb848edd9db2a06c0a4fe4975bf4d82abcfbb83c253d3
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf20:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrY
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1952 backup.exe 1692 data.exe 940 backup.exe 1928 System Restore.exe 836 backup.exe 1120 backup.exe 1080 backup.exe 2040 backup.exe 1856 backup.exe 1048 backup.exe 1616 backup.exe 1540 backup.exe 1472 backup.exe 864 update.exe 972 backup.exe 1600 System Restore.exe 920 backup.exe 1740 System Restore.exe 800 backup.exe 1868 backup.exe 1288 backup.exe 240 backup.exe 1460 backup.exe 1132 backup.exe 828 backup.exe 1796 backup.exe 1772 backup.exe 1120 backup.exe 1724 backup.exe 1696 backup.exe 1572 backup.exe 1052 backup.exe 1080 backup.exe 1732 backup.exe 1988 backup.exe 320 backup.exe 1436 backup.exe 2008 backup.exe 1664 backup.exe 712 backup.exe 1536 backup.exe 996 backup.exe 548 backup.exe 1668 backup.exe 1744 backup.exe 788 backup.exe 1620 backup.exe 304 backup.exe 984 backup.exe 1960 backup.exe 1448 backup.exe 1132 backup.exe 1784 backup.exe 1464 backup.exe 832 backup.exe 1640 backup.exe 1212 backup.exe 1856 System Restore.exe 1520 backup.exe 1976 backup.exe 2000 backup.exe 396 backup.exe 1436 backup.exe 1192 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1928 System Restore.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1928 System Restore.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1080 backup.exe 1080 backup.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1928 System Restore.exe 1928 System Restore.exe 1616 backup.exe 1616 backup.exe 1540 backup.exe 1540 backup.exe 1616 backup.exe 864 update.exe 864 update.exe 864 update.exe 864 update.exe 864 update.exe 972 backup.exe 972 backup.exe 972 backup.exe 972 backup.exe 972 backup.exe 1600 System Restore.exe 1600 System Restore.exe 1600 System Restore.exe 972 backup.exe 972 backup.exe 920 backup.exe 920 backup.exe 920 backup.exe 920 backup.exe 920 backup.exe 1740 System Restore.exe 1740 System Restore.exe 1740 System Restore.exe 920 backup.exe 920 backup.exe 800 backup.exe 800 backup.exe 800 backup.exe 920 backup.exe 920 backup.exe 1868 backup.exe 1868 backup.exe 1868 backup.exe 920 backup.exe 920 backup.exe 1288 backup.exe 1288 backup.exe 1288 backup.exe 1928 System Restore.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\update.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\update.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Update\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\backup.exe System Restore.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\AppPatch64\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\de-DE\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\es-ES\backup.exe backup.exe File opened for modification C:\Windows\CSC\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\en-US\backup.exe backup.exe File opened for modification C:\Windows\Cursors\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\Custom\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 1952 backup.exe 1692 data.exe 940 backup.exe 1928 System Restore.exe 836 backup.exe 1080 backup.exe 1120 backup.exe 2040 backup.exe 1856 backup.exe 1048 backup.exe 1616 backup.exe 1540 backup.exe 1472 backup.exe 864 update.exe 972 backup.exe 1600 System Restore.exe 920 backup.exe 1740 System Restore.exe 800 backup.exe 1868 backup.exe 1288 backup.exe 240 backup.exe 1460 backup.exe 1132 backup.exe 828 backup.exe 1796 backup.exe 1772 backup.exe 1120 backup.exe 1724 backup.exe 1696 backup.exe 1572 backup.exe 1052 backup.exe 1080 backup.exe 1732 backup.exe 1988 backup.exe 320 backup.exe 1436 backup.exe 2008 backup.exe 1664 backup.exe 712 backup.exe 1536 backup.exe 996 backup.exe 548 backup.exe 788 backup.exe 1620 backup.exe 1668 backup.exe 1744 backup.exe 984 backup.exe 1960 backup.exe 304 backup.exe 1448 backup.exe 1132 backup.exe 1784 backup.exe 832 backup.exe 1464 backup.exe 1640 backup.exe 1212 backup.exe 1856 System Restore.exe 1520 backup.exe 1976 backup.exe 2000 backup.exe 396 backup.exe 1436 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1952 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 26 PID 1612 wrote to memory of 1952 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 26 PID 1612 wrote to memory of 1952 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 26 PID 1612 wrote to memory of 1952 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 26 PID 1612 wrote to memory of 1692 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 27 PID 1612 wrote to memory of 1692 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 27 PID 1612 wrote to memory of 1692 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 27 PID 1612 wrote to memory of 1692 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 27 PID 1612 wrote to memory of 940 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 28 PID 1612 wrote to memory of 940 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 28 PID 1612 wrote to memory of 940 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 28 PID 1612 wrote to memory of 940 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 28 PID 1952 wrote to memory of 1928 1952 backup.exe 29 PID 1952 wrote to memory of 1928 1952 backup.exe 29 PID 1952 wrote to memory of 1928 1952 backup.exe 29 PID 1952 wrote to memory of 1928 1952 backup.exe 29 PID 1612 wrote to memory of 836 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 30 PID 1612 wrote to memory of 836 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 30 PID 1612 wrote to memory of 836 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 30 PID 1612 wrote to memory of 836 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 30 PID 1612 wrote to memory of 1120 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 31 PID 1612 wrote to memory of 1120 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 31 PID 1612 wrote to memory of 1120 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 31 PID 1612 wrote to memory of 1120 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 31 PID 1928 wrote to memory of 1080 1928 System Restore.exe 32 PID 1928 wrote to memory of 1080 1928 System Restore.exe 32 PID 1928 wrote to memory of 1080 1928 System Restore.exe 32 PID 1928 wrote to memory of 1080 1928 System Restore.exe 32 PID 1612 wrote to memory of 2040 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 33 PID 1612 wrote to memory of 2040 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 33 PID 1612 wrote to memory of 2040 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 33 PID 1612 wrote to memory of 2040 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 33 PID 1080 wrote to memory of 1856 1080 backup.exe 34 PID 1080 wrote to memory of 1856 1080 backup.exe 34 PID 1080 wrote to memory of 1856 1080 backup.exe 34 PID 1080 wrote to memory of 1856 1080 backup.exe 34 PID 1612 wrote to memory of 1048 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 35 PID 1612 wrote to memory of 1048 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 35 PID 1612 wrote to memory of 1048 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 35 PID 1612 wrote to memory of 1048 1612 a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe 35 PID 1928 wrote to memory of 1616 1928 System Restore.exe 36 PID 1928 wrote to memory of 1616 1928 System Restore.exe 36 PID 1928 wrote to memory of 1616 1928 System Restore.exe 36 PID 1928 wrote to memory of 1616 1928 System Restore.exe 36 PID 1616 wrote to memory of 1540 1616 backup.exe 37 PID 1616 wrote to memory of 1540 1616 backup.exe 37 PID 1616 wrote to memory of 1540 1616 backup.exe 37 PID 1616 wrote to memory of 1540 1616 backup.exe 37 PID 1540 wrote to memory of 1472 1540 backup.exe 38 PID 1540 wrote to memory of 1472 1540 backup.exe 38 PID 1540 wrote to memory of 1472 1540 backup.exe 38 PID 1540 wrote to memory of 1472 1540 backup.exe 38 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 1616 wrote to memory of 864 1616 backup.exe 39 PID 864 wrote to memory of 972 864 update.exe 40 PID 864 wrote to memory of 972 864 update.exe 40 PID 864 wrote to memory of 972 864 update.exe 40 PID 864 wrote to memory of 972 864 update.exe 40 PID 864 wrote to memory of 972 864 update.exe 40 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe"C:\Users\Admin\AppData\Local\Temp\a1ffe41cfc026bf63445997ddcb0b4d73b14264bd5d5038b4f1b795de64a5f47.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1238487887\backup.exeC:\Users\Admin\AppData\Local\Temp\1238487887\backup.exe C:\Users\Admin\AppData\Local\Temp\1238487887\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\System Restore.exe"\System Restore.exe" \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1080 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1472
-
-
-
C:\Program Files\Common Files\update.exe"C:\Program Files\Common Files\update.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:920 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1288
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1960 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:548
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:1140
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
PID:1608
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Disables RegEdit via registry modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:1608
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:2112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:2352
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:2608
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1664 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:304
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1292
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:656 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1456
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:820 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1056
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:2084
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:2384
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:2600
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2260
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2512
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1732 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1132 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:396
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1708
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1680
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:984
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:864
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:316
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
PID:1644
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:2020
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:996
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1400
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2276
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2520
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1772 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1052
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:320
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:996
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:984
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:832
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1416 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1232
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:288
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:2040
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1280
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1812
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:2268
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:2504
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1192 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- System policy modification
PID:268 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1936 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1604 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1472
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵PID:2660
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:836
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1708 -
C:\Program Files\Internet Explorer\de-DE\update.exe"C:\Program Files\Internet Explorer\de-DE\update.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- System policy modification
PID:1776
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- System policy modification
PID:992
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:572
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1964
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2212
-
-
C:\Program Files\Internet Explorer\it-IT\update.exe"C:\Program Files\Internet Explorer\it-IT\update.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2472
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵PID:2676
-
-
-
C:\Program Files\Java\data.exe"C:\Program Files\Java\data.exe" C:\Program Files\Java\5⤵PID:316
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1448
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2160
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2428
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2652
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:828 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1120 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1080 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:712
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:788
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1752
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1468 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1908
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
PID:1596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
PID:2008 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:1140
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:2128
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:2340
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:2588
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1928
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:2092
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2376
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1732 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:996
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
PID:1092
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- System policy modification
PID:1920
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1856 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:828
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵PID:1472
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1976
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1600
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Disables RegEdit via registry modification
PID:712 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- Disables RegEdit via registry modification
PID:1608
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1436 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
PID:1860 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:320
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:304 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:364 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1364 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵PID:2308
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1720
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1640 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1772 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵PID:1584
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2004
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1592
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2252
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2496
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
PID:320 -
C:\Program Files (x86)\Google\CrashReports\update.exe"C:\Program Files (x86)\Google\CrashReports\update.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:788
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:580
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1972
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:2220
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1184
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2572
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:548
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:904
-
-
C:\Users\Admin\Documents\update.exeC:\Users\Admin\Documents\update.exe C:\Users\Admin\Documents\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1396
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
PID:592
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1748
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:1456
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:764
-
-
C:\Users\Admin\Pictures\data.exeC:\Users\Admin\Pictures\data.exe C:\Users\Admin\Pictures\6⤵PID:2068
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:2328
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:2624
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1740 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Modifies visibility of file extensions in Explorer
PID:2016
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1800
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:832
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:2228
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵PID:2488
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:1176 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Disables RegEdit via registry modification
PID:1748
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
- Modifies visibility of file extensions in Explorer
PID:1940
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:1696 -
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\6⤵PID:1764
-
-
C:\Windows\AppPatch\Custom\backup.exeC:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\6⤵PID:268
-
-
C:\Windows\AppPatch\de-DE\backup.exeC:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\6⤵PID:2076
-
-
C:\Windows\AppPatch\en-US\backup.exeC:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\6⤵PID:2360
-
-
C:\Windows\AppPatch\es-ES\backup.exeC:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\6⤵PID:2616
-
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1116
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:1684
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:2300
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵PID:2560
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1048
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD508a60ca47afb008dfa603bcf2a644aff
SHA118b5cde37b1f1996b52b4c0956b0955f34582888
SHA256cd4be020e841dd699152dbaec507148a34175d022760931f211962d1f4cdcfbb
SHA5129c29d110fcc8a35938422a968bf05f1cfde66e1ededb1c2264fe37c89f906648d464b90dfe9c1c9bc235709efd8e4c8336cc644c0dc21748836b83f8b67cc521
-
Filesize
72KB
MD5b18449c7982eb993465a171b8f26bd75
SHA15a422b8331eaf6b355f8c894591ead5e410f06eb
SHA2563c5d2ac35d7d8ca9a38f46b4340a730c96007532e4c75604490f2a42d8e59ea3
SHA5123c4d26208b2aef1d974c0d87758b75514e52a145257bdd045643bc1af685029c4c6910c3ad9659469b0750bfa9ddbc97e996f8b78d3f259dcedbab558acec06c
-
Filesize
72KB
MD5b18449c7982eb993465a171b8f26bd75
SHA15a422b8331eaf6b355f8c894591ead5e410f06eb
SHA2563c5d2ac35d7d8ca9a38f46b4340a730c96007532e4c75604490f2a42d8e59ea3
SHA5123c4d26208b2aef1d974c0d87758b75514e52a145257bdd045643bc1af685029c4c6910c3ad9659469b0750bfa9ddbc97e996f8b78d3f259dcedbab558acec06c
-
Filesize
72KB
MD5619e276d5d76de7073e459436894c035
SHA13ecb94cd5bec8a487fa637668252b13224ae2cf3
SHA256eb9524a6bbbb6c9111102a7e52a5d08e1ce42bec155453695579950e34902618
SHA5123e60f56a7f07e79727497d2ce36b94df6e140c02dcee2360046823c6d6aa59a73c2977cf38764b1fed20448b65b38f99e80cd982959ff070963a224bf4ef7e4e
-
Filesize
72KB
MD585dc5d48070dac580efd81dc9c166497
SHA14e6183785dead247d84250ce0b580582d28fd3d6
SHA2566ae1560680c0062376b1e5e36d923b2a87eea73d8a621d48fc7a6ae91a72f57b
SHA512aec842c1fa7b67fdafe83b637c532365cfdca0e43af79647bfdaab729542982df7ecab70a3d23523357127cb6a9b79bf35ff4c84707c725da3f1d32a70e4cb4c
-
Filesize
72KB
MD585dc5d48070dac580efd81dc9c166497
SHA14e6183785dead247d84250ce0b580582d28fd3d6
SHA2566ae1560680c0062376b1e5e36d923b2a87eea73d8a621d48fc7a6ae91a72f57b
SHA512aec842c1fa7b67fdafe83b637c532365cfdca0e43af79647bfdaab729542982df7ecab70a3d23523357127cb6a9b79bf35ff4c84707c725da3f1d32a70e4cb4c
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5bea7ab96efdf42e76c785fbf32a0969e
SHA1b828ac656a61e2b010fd35fad97d843b231a02ac
SHA25673354678a8c645cd632d85e045c49c670acd4e7dd7405cb2c74e9b8fd6d0addc
SHA512502ede04f797fdaf68a34bbebc9857a037a34d7cfa43b729b3f0960989742fcad01243aee4cdedc8f51854d814232e2748ce0a6715ff8c65957cd6d78835fd35
-
Filesize
72KB
MD5bea7ab96efdf42e76c785fbf32a0969e
SHA1b828ac656a61e2b010fd35fad97d843b231a02ac
SHA25673354678a8c645cd632d85e045c49c670acd4e7dd7405cb2c74e9b8fd6d0addc
SHA512502ede04f797fdaf68a34bbebc9857a037a34d7cfa43b729b3f0960989742fcad01243aee4cdedc8f51854d814232e2748ce0a6715ff8c65957cd6d78835fd35
-
Filesize
72KB
MD570e9bacf99d83a59bea870f561005a60
SHA1ae68ca5b0ac82701948accd0346af7cb4790307c
SHA25668ae053289c8fe3b0112e438dd9439a697c183183e4a9d64ed4ed7aba39290ed
SHA5120467514a1c8ee3f809d4205158a8980d8d852bf7cfddd801451e2383b4bea80ee2df49d2638003d831b30a517628fa7e2ad7e00ef3d67ddbc5e7277507b6be8a
-
Filesize
72KB
MD570e9bacf99d83a59bea870f561005a60
SHA1ae68ca5b0ac82701948accd0346af7cb4790307c
SHA25668ae053289c8fe3b0112e438dd9439a697c183183e4a9d64ed4ed7aba39290ed
SHA5120467514a1c8ee3f809d4205158a8980d8d852bf7cfddd801451e2383b4bea80ee2df49d2638003d831b30a517628fa7e2ad7e00ef3d67ddbc5e7277507b6be8a
-
Filesize
72KB
MD5bbe280ee79ec839a3c83bbdface33654
SHA1d8fce83f93bd82aed8a0874f6d268aed9c6de9d1
SHA256952ef6452d6802d1928d8fafd7b03fe2ab878dcc188739935021c5be578ff646
SHA51202ac133f7876c45f2ff934cd54719711c7ee17c802a77b15b74df66dc7700fbeac0680a122b79f793f9d2126f31063dd5e2f29fdc4e6a126113fb53c8279eb77
-
Filesize
72KB
MD5bbe280ee79ec839a3c83bbdface33654
SHA1d8fce83f93bd82aed8a0874f6d268aed9c6de9d1
SHA256952ef6452d6802d1928d8fafd7b03fe2ab878dcc188739935021c5be578ff646
SHA51202ac133f7876c45f2ff934cd54719711c7ee17c802a77b15b74df66dc7700fbeac0680a122b79f793f9d2126f31063dd5e2f29fdc4e6a126113fb53c8279eb77
-
Filesize
72KB
MD512a49a7fce509ac6434864719a588ee5
SHA112f9d0495396e2ca0d7efe2b14a4cb75645b0524
SHA256b7e63efea21893bdde30304f9659d02b5f0d38f01eb508024120f2db6652ac4f
SHA51209592b106976cf93b1168ffa3cd59a7843b6c2871fb3830b7ec57e0215ca352359408ec21a537095c221a543f00f62c1fb73d292e57a64ebc0ac6916eb901d41
-
Filesize
72KB
MD512a49a7fce509ac6434864719a588ee5
SHA112f9d0495396e2ca0d7efe2b14a4cb75645b0524
SHA256b7e63efea21893bdde30304f9659d02b5f0d38f01eb508024120f2db6652ac4f
SHA51209592b106976cf93b1168ffa3cd59a7843b6c2871fb3830b7ec57e0215ca352359408ec21a537095c221a543f00f62c1fb73d292e57a64ebc0ac6916eb901d41
-
Filesize
72KB
MD57f0952a212074780519b2cb9a3828d60
SHA11c8c7bbd2f61473c7e6acee3812ced7a69039252
SHA256ca6e789bbebe2d0738172cb0ed2982ce99c2d81a5f4e3311cfb46963d53bb23d
SHA51273977a0a966f72b9b1d79d6775b2ede18a89434dacd910313ae5b32109e4ac6f060117dedeab1814672a47e37efedab5acbc5cfeb45cda765b84d5865a98390f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57f0952a212074780519b2cb9a3828d60
SHA11c8c7bbd2f61473c7e6acee3812ced7a69039252
SHA256ca6e789bbebe2d0738172cb0ed2982ce99c2d81a5f4e3311cfb46963d53bb23d
SHA51273977a0a966f72b9b1d79d6775b2ede18a89434dacd910313ae5b32109e4ac6f060117dedeab1814672a47e37efedab5acbc5cfeb45cda765b84d5865a98390f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a6945e12baf2c69f09195fc651500cd7
SHA1dbb3b9cb85d273baafdd5fd529655d772cd43495
SHA25621e19ade5d4d6f01e4862deffb07c5a6912a885c569f1616279d15a15825ce7e
SHA51251b044204d8d46d80f3538cc2bb938fb4daac1ffd9b7ac6d04bb7d79154e7b0330e65e18a91b8395cbacb5367a49340ba82331d08c7d7297561d82b88f38a7dd
-
Filesize
72KB
MD5582e89bff30624681e8cae191ee326dc
SHA1c7c3d5accbc0ef27229bf07bebb05feda3faf76d
SHA256e127e53cae7418992f741f08745ecfd9eaec66ef14eda5ede2e776c779dea550
SHA512743bbe873a5ee99eb9cdd63b1ee4b877b4e2f8a9bef093af5ff13d80c59e5e7e21b0a65be0639f6f6e04db98126f871b3ba742f5a26aa95ce5b4cb67f96fa93a
-
Filesize
72KB
MD5aad87cd63aacaf00e18658e6ef9377e8
SHA1362ec42f3a249b424f63c87b7ade5065659b0734
SHA25651c170e549988d449857d3bd52fb80858166a7b8bce08586063fe07d0cac3a28
SHA512ce5012f6654e8a7898996c28ade3a6728542e63e53fdc5e54a9b98270aabe9576536bba620b317572644fedbe5548b181ff41ed98ebd350465c47f9f3feca107
-
Filesize
72KB
MD5582e89bff30624681e8cae191ee326dc
SHA1c7c3d5accbc0ef27229bf07bebb05feda3faf76d
SHA256e127e53cae7418992f741f08745ecfd9eaec66ef14eda5ede2e776c779dea550
SHA512743bbe873a5ee99eb9cdd63b1ee4b877b4e2f8a9bef093af5ff13d80c59e5e7e21b0a65be0639f6f6e04db98126f871b3ba742f5a26aa95ce5b4cb67f96fa93a
-
Filesize
72KB
MD508a60ca47afb008dfa603bcf2a644aff
SHA118b5cde37b1f1996b52b4c0956b0955f34582888
SHA256cd4be020e841dd699152dbaec507148a34175d022760931f211962d1f4cdcfbb
SHA5129c29d110fcc8a35938422a968bf05f1cfde66e1ededb1c2264fe37c89f906648d464b90dfe9c1c9bc235709efd8e4c8336cc644c0dc21748836b83f8b67cc521
-
Filesize
72KB
MD508a60ca47afb008dfa603bcf2a644aff
SHA118b5cde37b1f1996b52b4c0956b0955f34582888
SHA256cd4be020e841dd699152dbaec507148a34175d022760931f211962d1f4cdcfbb
SHA5129c29d110fcc8a35938422a968bf05f1cfde66e1ededb1c2264fe37c89f906648d464b90dfe9c1c9bc235709efd8e4c8336cc644c0dc21748836b83f8b67cc521
-
Filesize
72KB
MD5b18449c7982eb993465a171b8f26bd75
SHA15a422b8331eaf6b355f8c894591ead5e410f06eb
SHA2563c5d2ac35d7d8ca9a38f46b4340a730c96007532e4c75604490f2a42d8e59ea3
SHA5123c4d26208b2aef1d974c0d87758b75514e52a145257bdd045643bc1af685029c4c6910c3ad9659469b0750bfa9ddbc97e996f8b78d3f259dcedbab558acec06c
-
Filesize
72KB
MD5b18449c7982eb993465a171b8f26bd75
SHA15a422b8331eaf6b355f8c894591ead5e410f06eb
SHA2563c5d2ac35d7d8ca9a38f46b4340a730c96007532e4c75604490f2a42d8e59ea3
SHA5123c4d26208b2aef1d974c0d87758b75514e52a145257bdd045643bc1af685029c4c6910c3ad9659469b0750bfa9ddbc97e996f8b78d3f259dcedbab558acec06c
-
Filesize
72KB
MD5619e276d5d76de7073e459436894c035
SHA13ecb94cd5bec8a487fa637668252b13224ae2cf3
SHA256eb9524a6bbbb6c9111102a7e52a5d08e1ce42bec155453695579950e34902618
SHA5123e60f56a7f07e79727497d2ce36b94df6e140c02dcee2360046823c6d6aa59a73c2977cf38764b1fed20448b65b38f99e80cd982959ff070963a224bf4ef7e4e
-
Filesize
72KB
MD5619e276d5d76de7073e459436894c035
SHA13ecb94cd5bec8a487fa637668252b13224ae2cf3
SHA256eb9524a6bbbb6c9111102a7e52a5d08e1ce42bec155453695579950e34902618
SHA5123e60f56a7f07e79727497d2ce36b94df6e140c02dcee2360046823c6d6aa59a73c2977cf38764b1fed20448b65b38f99e80cd982959ff070963a224bf4ef7e4e
-
Filesize
72KB
MD585dc5d48070dac580efd81dc9c166497
SHA14e6183785dead247d84250ce0b580582d28fd3d6
SHA2566ae1560680c0062376b1e5e36d923b2a87eea73d8a621d48fc7a6ae91a72f57b
SHA512aec842c1fa7b67fdafe83b637c532365cfdca0e43af79647bfdaab729542982df7ecab70a3d23523357127cb6a9b79bf35ff4c84707c725da3f1d32a70e4cb4c
-
Filesize
72KB
MD585dc5d48070dac580efd81dc9c166497
SHA14e6183785dead247d84250ce0b580582d28fd3d6
SHA2566ae1560680c0062376b1e5e36d923b2a87eea73d8a621d48fc7a6ae91a72f57b
SHA512aec842c1fa7b67fdafe83b637c532365cfdca0e43af79647bfdaab729542982df7ecab70a3d23523357127cb6a9b79bf35ff4c84707c725da3f1d32a70e4cb4c
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5c284d0710d92dce1f24c5d6210aa16fd
SHA1e3c676fcf3f6d468f0b5f7ef64a792e563646bcb
SHA256c71df22ff3e95daf03b7cd75b3b7d66d0b487d1e458ca706cf430fd2b49e9d4f
SHA512a4cfc7e60b3c9ff7b11c683624cf492a936c3d1d8ed22b91f074fc0d4322206b501f16e04308fc89365653140c8411570bb7ce956e0597fb72c29d1dc7f4895a
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5be4cf0010845cfb79d1ef7d65a48f8da
SHA1cd1aeae6e95473edec49aa39cfe9f55de759b742
SHA256a5dab6dce26f47e0797ca5c334258e7a86ccea875a7014b2649cea06696234d8
SHA512b7c757e202e7a40fc691d56c2237007a63062c5f3b8d4b0f7b0c836c5d653f72c527cf2f5e5cc11d8d77a0a7f0a9b939d020875e85ca1afc160b9bf0c7e673e0
-
Filesize
72KB
MD5c155bed88ce53f96ca2b9a863480007d
SHA1131151804d72451dfa692b0bece30456672ae37d
SHA2567d6ab3bc3c496f5c6bd2ad608273e3c34de526c5e835c5894beba3a578be00dc
SHA512f5cd9f488e0ba9993485ff4de1e4db3988c6fd1fc21eee1265910c3212dcfa97f8fd890850e209eac5594745da9296e8cf254c0c3c5db1c87347c47492a58fa9
-
Filesize
72KB
MD5c155bed88ce53f96ca2b9a863480007d
SHA1131151804d72451dfa692b0bece30456672ae37d
SHA2567d6ab3bc3c496f5c6bd2ad608273e3c34de526c5e835c5894beba3a578be00dc
SHA512f5cd9f488e0ba9993485ff4de1e4db3988c6fd1fc21eee1265910c3212dcfa97f8fd890850e209eac5594745da9296e8cf254c0c3c5db1c87347c47492a58fa9
-
Filesize
72KB
MD5bea7ab96efdf42e76c785fbf32a0969e
SHA1b828ac656a61e2b010fd35fad97d843b231a02ac
SHA25673354678a8c645cd632d85e045c49c670acd4e7dd7405cb2c74e9b8fd6d0addc
SHA512502ede04f797fdaf68a34bbebc9857a037a34d7cfa43b729b3f0960989742fcad01243aee4cdedc8f51854d814232e2748ce0a6715ff8c65957cd6d78835fd35
-
Filesize
72KB
MD5bea7ab96efdf42e76c785fbf32a0969e
SHA1b828ac656a61e2b010fd35fad97d843b231a02ac
SHA25673354678a8c645cd632d85e045c49c670acd4e7dd7405cb2c74e9b8fd6d0addc
SHA512502ede04f797fdaf68a34bbebc9857a037a34d7cfa43b729b3f0960989742fcad01243aee4cdedc8f51854d814232e2748ce0a6715ff8c65957cd6d78835fd35
-
Filesize
72KB
MD5bea7ab96efdf42e76c785fbf32a0969e
SHA1b828ac656a61e2b010fd35fad97d843b231a02ac
SHA25673354678a8c645cd632d85e045c49c670acd4e7dd7405cb2c74e9b8fd6d0addc
SHA512502ede04f797fdaf68a34bbebc9857a037a34d7cfa43b729b3f0960989742fcad01243aee4cdedc8f51854d814232e2748ce0a6715ff8c65957cd6d78835fd35
-
Filesize
72KB
MD5bea7ab96efdf42e76c785fbf32a0969e
SHA1b828ac656a61e2b010fd35fad97d843b231a02ac
SHA25673354678a8c645cd632d85e045c49c670acd4e7dd7405cb2c74e9b8fd6d0addc
SHA512502ede04f797fdaf68a34bbebc9857a037a34d7cfa43b729b3f0960989742fcad01243aee4cdedc8f51854d814232e2748ce0a6715ff8c65957cd6d78835fd35
-
Filesize
72KB
MD570e9bacf99d83a59bea870f561005a60
SHA1ae68ca5b0ac82701948accd0346af7cb4790307c
SHA25668ae053289c8fe3b0112e438dd9439a697c183183e4a9d64ed4ed7aba39290ed
SHA5120467514a1c8ee3f809d4205158a8980d8d852bf7cfddd801451e2383b4bea80ee2df49d2638003d831b30a517628fa7e2ad7e00ef3d67ddbc5e7277507b6be8a
-
Filesize
72KB
MD570e9bacf99d83a59bea870f561005a60
SHA1ae68ca5b0ac82701948accd0346af7cb4790307c
SHA25668ae053289c8fe3b0112e438dd9439a697c183183e4a9d64ed4ed7aba39290ed
SHA5120467514a1c8ee3f809d4205158a8980d8d852bf7cfddd801451e2383b4bea80ee2df49d2638003d831b30a517628fa7e2ad7e00ef3d67ddbc5e7277507b6be8a
-
Filesize
72KB
MD512a49a7fce509ac6434864719a588ee5
SHA112f9d0495396e2ca0d7efe2b14a4cb75645b0524
SHA256b7e63efea21893bdde30304f9659d02b5f0d38f01eb508024120f2db6652ac4f
SHA51209592b106976cf93b1168ffa3cd59a7843b6c2871fb3830b7ec57e0215ca352359408ec21a537095c221a543f00f62c1fb73d292e57a64ebc0ac6916eb901d41
-
Filesize
72KB
MD512a49a7fce509ac6434864719a588ee5
SHA112f9d0495396e2ca0d7efe2b14a4cb75645b0524
SHA256b7e63efea21893bdde30304f9659d02b5f0d38f01eb508024120f2db6652ac4f
SHA51209592b106976cf93b1168ffa3cd59a7843b6c2871fb3830b7ec57e0215ca352359408ec21a537095c221a543f00f62c1fb73d292e57a64ebc0ac6916eb901d41
-
Filesize
72KB
MD57f0952a212074780519b2cb9a3828d60
SHA11c8c7bbd2f61473c7e6acee3812ced7a69039252
SHA256ca6e789bbebe2d0738172cb0ed2982ce99c2d81a5f4e3311cfb46963d53bb23d
SHA51273977a0a966f72b9b1d79d6775b2ede18a89434dacd910313ae5b32109e4ac6f060117dedeab1814672a47e37efedab5acbc5cfeb45cda765b84d5865a98390f
-
Filesize
72KB
MD57f0952a212074780519b2cb9a3828d60
SHA11c8c7bbd2f61473c7e6acee3812ced7a69039252
SHA256ca6e789bbebe2d0738172cb0ed2982ce99c2d81a5f4e3311cfb46963d53bb23d
SHA51273977a0a966f72b9b1d79d6775b2ede18a89434dacd910313ae5b32109e4ac6f060117dedeab1814672a47e37efedab5acbc5cfeb45cda765b84d5865a98390f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57f0952a212074780519b2cb9a3828d60
SHA11c8c7bbd2f61473c7e6acee3812ced7a69039252
SHA256ca6e789bbebe2d0738172cb0ed2982ce99c2d81a5f4e3311cfb46963d53bb23d
SHA51273977a0a966f72b9b1d79d6775b2ede18a89434dacd910313ae5b32109e4ac6f060117dedeab1814672a47e37efedab5acbc5cfeb45cda765b84d5865a98390f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57f0952a212074780519b2cb9a3828d60
SHA11c8c7bbd2f61473c7e6acee3812ced7a69039252
SHA256ca6e789bbebe2d0738172cb0ed2982ce99c2d81a5f4e3311cfb46963d53bb23d
SHA51273977a0a966f72b9b1d79d6775b2ede18a89434dacd910313ae5b32109e4ac6f060117dedeab1814672a47e37efedab5acbc5cfeb45cda765b84d5865a98390f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a6945e12baf2c69f09195fc651500cd7
SHA1dbb3b9cb85d273baafdd5fd529655d772cd43495
SHA25621e19ade5d4d6f01e4862deffb07c5a6912a885c569f1616279d15a15825ce7e
SHA51251b044204d8d46d80f3538cc2bb938fb4daac1ffd9b7ac6d04bb7d79154e7b0330e65e18a91b8395cbacb5367a49340ba82331d08c7d7297561d82b88f38a7dd
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5a6945e12baf2c69f09195fc651500cd7
SHA1dbb3b9cb85d273baafdd5fd529655d772cd43495
SHA25621e19ade5d4d6f01e4862deffb07c5a6912a885c569f1616279d15a15825ce7e
SHA51251b044204d8d46d80f3538cc2bb938fb4daac1ffd9b7ac6d04bb7d79154e7b0330e65e18a91b8395cbacb5367a49340ba82331d08c7d7297561d82b88f38a7dd
-
Filesize
72KB
MD5582e89bff30624681e8cae191ee326dc
SHA1c7c3d5accbc0ef27229bf07bebb05feda3faf76d
SHA256e127e53cae7418992f741f08745ecfd9eaec66ef14eda5ede2e776c779dea550
SHA512743bbe873a5ee99eb9cdd63b1ee4b877b4e2f8a9bef093af5ff13d80c59e5e7e21b0a65be0639f6f6e04db98126f871b3ba742f5a26aa95ce5b4cb67f96fa93a
-
Filesize
72KB
MD5582e89bff30624681e8cae191ee326dc
SHA1c7c3d5accbc0ef27229bf07bebb05feda3faf76d
SHA256e127e53cae7418992f741f08745ecfd9eaec66ef14eda5ede2e776c779dea550
SHA512743bbe873a5ee99eb9cdd63b1ee4b877b4e2f8a9bef093af5ff13d80c59e5e7e21b0a65be0639f6f6e04db98126f871b3ba742f5a26aa95ce5b4cb67f96fa93a
-
Filesize
72KB
MD5aad87cd63aacaf00e18658e6ef9377e8
SHA1362ec42f3a249b424f63c87b7ade5065659b0734
SHA25651c170e549988d449857d3bd52fb80858166a7b8bce08586063fe07d0cac3a28
SHA512ce5012f6654e8a7898996c28ade3a6728542e63e53fdc5e54a9b98270aabe9576536bba620b317572644fedbe5548b181ff41ed98ebd350465c47f9f3feca107
-
Filesize
72KB
MD5aad87cd63aacaf00e18658e6ef9377e8
SHA1362ec42f3a249b424f63c87b7ade5065659b0734
SHA25651c170e549988d449857d3bd52fb80858166a7b8bce08586063fe07d0cac3a28
SHA512ce5012f6654e8a7898996c28ade3a6728542e63e53fdc5e54a9b98270aabe9576536bba620b317572644fedbe5548b181ff41ed98ebd350465c47f9f3feca107
-
Filesize
72KB
MD5582e89bff30624681e8cae191ee326dc
SHA1c7c3d5accbc0ef27229bf07bebb05feda3faf76d
SHA256e127e53cae7418992f741f08745ecfd9eaec66ef14eda5ede2e776c779dea550
SHA512743bbe873a5ee99eb9cdd63b1ee4b877b4e2f8a9bef093af5ff13d80c59e5e7e21b0a65be0639f6f6e04db98126f871b3ba742f5a26aa95ce5b4cb67f96fa93a
-
Filesize
72KB
MD5582e89bff30624681e8cae191ee326dc
SHA1c7c3d5accbc0ef27229bf07bebb05feda3faf76d
SHA256e127e53cae7418992f741f08745ecfd9eaec66ef14eda5ede2e776c779dea550
SHA512743bbe873a5ee99eb9cdd63b1ee4b877b4e2f8a9bef093af5ff13d80c59e5e7e21b0a65be0639f6f6e04db98126f871b3ba742f5a26aa95ce5b4cb67f96fa93a