Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe
Resource
win10v2004-20220812-en
General
-
Target
226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe
-
Size
72KB
-
MD5
01d1587763dda17b7ae02a71b03ba4a3
-
SHA1
1f42998db5f36920a83f3d86ac9b765ee998571b
-
SHA256
226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e
-
SHA512
0abe26235832c79f6a93a6647dbe63ac50a5c7a1fce907aa224db60d48d8454b0270065dd6a5942a05cbad720ce1ab531d815b41ef805c0dd1b6d09ac143ab9d
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2W:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 276 update.exe 2036 update.exe 1988 backup.exe 1388 backup.exe 1004 backup.exe 1992 backup.exe 432 backup.exe 704 backup.exe 1948 backup.exe 540 backup.exe 1300 backup.exe 1048 data.exe 1600 backup.exe 1396 backup.exe 1112 backup.exe 1740 backup.exe 2036 backup.exe 1980 backup.exe 904 backup.exe 268 backup.exe 1168 backup.exe 1816 backup.exe 612 backup.exe 1596 backup.exe 1328 backup.exe 900 data.exe 1872 backup.exe 1744 backup.exe 1592 backup.exe 2012 backup.exe 576 backup.exe 1952 backup.exe 1636 backup.exe 588 backup.exe 296 backup.exe 1640 backup.exe 2016 backup.exe 1216 backup.exe 1748 backup.exe 2032 backup.exe 988 backup.exe 1916 backup.exe 584 backup.exe 1252 backup.exe 1052 backup.exe 1120 backup.exe 1624 backup.exe 1860 System Restore.exe 1752 System Restore.exe 840 backup.exe 308 backup.exe 1520 backup.exe 1556 backup.exe 548 backup.exe 696 backup.exe 812 backup.exe 1516 backup.exe 1552 data.exe 1960 backup.exe 1768 backup.exe 1320 backup.exe 1996 backup.exe 1048 System Restore.exe 2032 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 276 update.exe 276 update.exe 276 update.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 2036 update.exe 2036 update.exe 2036 update.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 704 backup.exe 704 backup.exe 1948 backup.exe 1948 backup.exe 1948 backup.exe 704 backup.exe 704 backup.exe 540 backup.exe 540 backup.exe 540 backup.exe 1948 backup.exe 1948 backup.exe 540 backup.exe 540 backup.exe 1300 backup.exe 1300 backup.exe 1300 backup.exe 1048 data.exe 1048 data.exe 1048 data.exe 540 backup.exe 540 backup.exe 704 backup.exe 704 backup.exe 1048 data.exe 1048 data.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1396 backup.exe 1396 backup.exe 1396 backup.exe 1112 backup.exe 1112 backup.exe 1112 backup.exe 1396 backup.exe 1396 backup.exe 1740 backup.exe 1740 backup.exe 1740 backup.exe 1600 backup.exe 1600 backup.exe 1740 backup.exe 1740 backup.exe 2036 backup.exe 2036 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe data.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\update.exe backup.exe File opened for modification C:\Windows\addins\backup.exe update.exe File opened for modification C:\Windows\AppCompat\backup.exe update.exe File opened for modification C:\Windows\AppPatch\backup.exe update.exe File opened for modification C:\Windows\assembly\backup.exe update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 276 update.exe 2036 update.exe 1988 backup.exe 1388 backup.exe 1004 backup.exe 1992 backup.exe 432 backup.exe 704 backup.exe 1948 backup.exe 540 backup.exe 1048 data.exe 1300 backup.exe 1396 backup.exe 1600 backup.exe 1112 backup.exe 1740 backup.exe 2036 backup.exe 1980 backup.exe 904 backup.exe 268 backup.exe 1168 backup.exe 1816 backup.exe 612 backup.exe 1596 backup.exe 1328 backup.exe 900 data.exe 1872 backup.exe 1744 backup.exe 1592 backup.exe 2012 backup.exe 576 backup.exe 1952 backup.exe 1636 backup.exe 588 backup.exe 1640 backup.exe 296 backup.exe 2016 backup.exe 1216 backup.exe 1748 backup.exe 2032 backup.exe 988 backup.exe 1916 backup.exe 584 backup.exe 1252 backup.exe 1052 backup.exe 1120 backup.exe 1624 backup.exe 1860 System Restore.exe 1752 System Restore.exe 840 backup.exe 308 backup.exe 1520 backup.exe 1556 backup.exe 548 backup.exe 696 backup.exe 812 backup.exe 1516 backup.exe 1552 data.exe 1960 backup.exe 1768 backup.exe 1320 backup.exe 1996 backup.exe 1048 System Restore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 276 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 28 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 2036 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 29 PID 1864 wrote to memory of 1988 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 30 PID 1864 wrote to memory of 1988 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 30 PID 1864 wrote to memory of 1988 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 30 PID 1864 wrote to memory of 1988 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 30 PID 1864 wrote to memory of 1388 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 31 PID 1864 wrote to memory of 1388 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 31 PID 1864 wrote to memory of 1388 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 31 PID 1864 wrote to memory of 1388 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 31 PID 1864 wrote to memory of 1004 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 32 PID 1864 wrote to memory of 1004 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 32 PID 1864 wrote to memory of 1004 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 32 PID 1864 wrote to memory of 1004 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 32 PID 1864 wrote to memory of 1992 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 33 PID 1864 wrote to memory of 1992 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 33 PID 1864 wrote to memory of 1992 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 33 PID 1864 wrote to memory of 1992 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 33 PID 1864 wrote to memory of 432 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 34 PID 1864 wrote to memory of 432 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 34 PID 1864 wrote to memory of 432 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 34 PID 1864 wrote to memory of 432 1864 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe 34 PID 276 wrote to memory of 704 276 update.exe 35 PID 276 wrote to memory of 704 276 update.exe 35 PID 276 wrote to memory of 704 276 update.exe 35 PID 276 wrote to memory of 704 276 update.exe 35 PID 276 wrote to memory of 704 276 update.exe 35 PID 276 wrote to memory of 704 276 update.exe 35 PID 276 wrote to memory of 704 276 update.exe 35 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 1948 704 backup.exe 36 PID 704 wrote to memory of 540 704 backup.exe 37 PID 704 wrote to memory of 540 704 backup.exe 37 PID 704 wrote to memory of 540 704 backup.exe 37 PID 704 wrote to memory of 540 704 backup.exe 37 PID 704 wrote to memory of 540 704 backup.exe 37 PID 704 wrote to memory of 540 704 backup.exe 37 PID 704 wrote to memory of 540 704 backup.exe 37 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 1948 wrote to memory of 1300 1948 backup.exe 38 PID 540 wrote to memory of 1048 540 backup.exe 39 PID 540 wrote to memory of 1048 540 backup.exe 39 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe"C:\Users\Admin\AppData\Local\Temp\226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\447984996\update.exeC:\Users\Admin\AppData\Local\Temp\447984996\update.exe C:\Users\Admin\AppData\Local\Temp\447984996\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:276 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1300
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files\7-Zip\data.exe"C:\Program Files\7-Zip\data.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1048 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1112
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1600 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1168 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:296
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1216
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1252
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1120 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1048
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Disables RegEdit via registry modification
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:564
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
PID:996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
PID:472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:1388
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:1392
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:548 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
PID:1400
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:472
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:2064
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1052
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1380
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:828
-
-
-
C:\Program Files\Common Files\Services\data.exe"C:\Program Files\Common Files\Services\data.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:576
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1736
-
-
C:\Program Files\Common Files\System\update.exe"C:\Program Files\Common Files\System\update.exe" C:\Program Files\Common Files\System\6⤵PID:1720
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1556 -
C:\Program Files\DVD Maker\de-DE\update.exe"C:\Program Files\DVD Maker\de-DE\update.exe" C:\Program Files\DVD Maker\de-DE\6⤵PID:544
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:2008
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:2072
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1768
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1100
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1228
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1300
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1768
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1916
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1396 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1740 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1816 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1636
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2016
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:584 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1624 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1860 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:840
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:812
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1996 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:2032
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:856
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- System policy modification
PID:1720
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1084 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:544 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1624
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2020
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1132 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1120
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1856
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1048
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1312
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1520 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
PID:1364 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1784
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1564
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1664
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:584 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵PID:1996
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1516
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1784
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2080
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
PID:368 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
PID:1664
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1372
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1400
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:928
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1352 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:524
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:704
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:984
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2056
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
PID:2008 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1216
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1236
-
-
-
C:\Windows\update.exeC:\Windows\update.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:1984 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1560
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1636
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1764
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1924
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5a6562a4296d7ad52eef925d470b6218a
SHA118ec31607ce953087328a4dacfcf65ade9867094
SHA256f23701438dad36df6d84520d4e30b928bbfbd536c616c694b7189efd6a6a9c4d
SHA5120498d254c96293dc46597a3cc58e5b2df7ea52b91b5d982b7e4fa6fab70036aab69a98d37783eab20511bef0347206098fc41d6c1163baede2f7c7164d2a265b
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD549cf212053725ff4a22dd3ea18405f45
SHA1462fddce5cf25f6ea5c2451b7c47bd78b784049b
SHA256651d346daf9d7465a2c30f503302d9a86e52ee13a135958403869642a4abfcca
SHA5125419d5689a32bab6f3b14269e6f9d1c310f13def57c6feb885ffba9263297bfe13358179dc406e80385a633e65886fba86491dfe9d369922077c8b21f8ea0f87
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD5fabe7f0b896a9cd49ccce309c953baac
SHA1aa5270b4a00181b05a1adc67a0829954808a269e
SHA2562412c418886920582358549b9f8b91b8cc616993de1d0aa5ba9b670dfc78dbde
SHA512f814e17d6591f49c063247a96a5750a55ccd7c4d8f52fe9cccfd67863a0e07253309e4962f8ae9b059cdbb8ee522292519fbbcc4578b44548442313460bd81bf
-
Filesize
72KB
MD5fabe7f0b896a9cd49ccce309c953baac
SHA1aa5270b4a00181b05a1adc67a0829954808a269e
SHA2562412c418886920582358549b9f8b91b8cc616993de1d0aa5ba9b670dfc78dbde
SHA512f814e17d6591f49c063247a96a5750a55ccd7c4d8f52fe9cccfd67863a0e07253309e4962f8ae9b059cdbb8ee522292519fbbcc4578b44548442313460bd81bf
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD5ce810c7efe0a2e9c290d6dd77e384da8
SHA1108e9ecb0a96723544adc822a8ec09d29c75dae0
SHA256f479625dc7afccbd020895bc25a880ce0aaa3977b02c64da65d7c2729e7754b5
SHA512d6193c117d0ee462cc8b45117d382a633b7df299cc4bf429101a41668f12c74be32057b613d5b4e685e2cd9ab9054765961e1fe8cb36557d81b95fbad2dad8f7
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD515bf047d4f9d2c8f7219dc8d5b08fbc4
SHA18044d9bae1e50abf9baa39863a4d9b8e3e2c0f18
SHA256c3b76bc6370d0273d696ea13d0f754287f614c8a60e7b591baa89ac6817d5044
SHA5126da3edf0961380e464e70b707747974ce18b2e12788ff1397db9bf3e91d5764a5bc89a05772cfdb1db6372843d2da9d70a6a7a5d26816d6a47ac3f19f4c84ed8
-
Filesize
72KB
MD57c9acab109aece3bbda94a03711ce08b
SHA1b591552a4235129530ac3895c37d670df82ebb2c
SHA25669d66bc33fb8d04505ed62f4a2453d97fdacfb4c51b0e5b17781040febab17c5
SHA512f3a908c15619692b21b4cfa67f105ea04e22900cb2837a0918b6fbec1121afa10e5049920ea423c0075a86ec0c1fd4eee795488cd44c81d3874903d18a80190d
-
Filesize
72KB
MD57c9acab109aece3bbda94a03711ce08b
SHA1b591552a4235129530ac3895c37d670df82ebb2c
SHA25669d66bc33fb8d04505ed62f4a2453d97fdacfb4c51b0e5b17781040febab17c5
SHA512f3a908c15619692b21b4cfa67f105ea04e22900cb2837a0918b6fbec1121afa10e5049920ea423c0075a86ec0c1fd4eee795488cd44c81d3874903d18a80190d
-
Filesize
72KB
MD516d1ae8f8dd86d2ce1d2122b72dc38ce
SHA10adf39631fe46ec97920a611ccf0939c47fc866d
SHA2561425bb911e7521e8e18f3c0e8ffc6bf5f187d42dc8116e5b3c95141303c8ae94
SHA51201f084486dd3ea6ceb5baa9ec7e793c8058d43a99020eacaf009e30e49d363cbe20ca5f60a474ee5238b576baaab3fce605cf2e6d515f1ad63a3cf75de1e0a1f
-
Filesize
72KB
MD516d1ae8f8dd86d2ce1d2122b72dc38ce
SHA10adf39631fe46ec97920a611ccf0939c47fc866d
SHA2561425bb911e7521e8e18f3c0e8ffc6bf5f187d42dc8116e5b3c95141303c8ae94
SHA51201f084486dd3ea6ceb5baa9ec7e793c8058d43a99020eacaf009e30e49d363cbe20ca5f60a474ee5238b576baaab3fce605cf2e6d515f1ad63a3cf75de1e0a1f
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5ff1ce8cd05b9683e5c773ede9b150278
SHA1239c19ced95f2cd4032f06b47af58f5d61f96e47
SHA256f62dbec11d4f31b2efcf2e9fc377496aa83a5c1f2b7a2c2085b849ac80d628a3
SHA51218fe43ce35c177fc643bb93cd910934299766a6c6814a74aeea35e6b170fb9bc10c0a06b94627e3cf82962064421c89648e79bca22aa6e33d7ac261c86591875
-
Filesize
72KB
MD5a6562a4296d7ad52eef925d470b6218a
SHA118ec31607ce953087328a4dacfcf65ade9867094
SHA256f23701438dad36df6d84520d4e30b928bbfbd536c616c694b7189efd6a6a9c4d
SHA5120498d254c96293dc46597a3cc58e5b2df7ea52b91b5d982b7e4fa6fab70036aab69a98d37783eab20511bef0347206098fc41d6c1163baede2f7c7164d2a265b
-
Filesize
72KB
MD5a6562a4296d7ad52eef925d470b6218a
SHA118ec31607ce953087328a4dacfcf65ade9867094
SHA256f23701438dad36df6d84520d4e30b928bbfbd536c616c694b7189efd6a6a9c4d
SHA5120498d254c96293dc46597a3cc58e5b2df7ea52b91b5d982b7e4fa6fab70036aab69a98d37783eab20511bef0347206098fc41d6c1163baede2f7c7164d2a265b
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD56a0efba97ce5381dacc432dd4d1b5162
SHA18b7ba4d5c745dd3015937b2e827e13d075d9656e
SHA256cd079c89a37faa8edfb865c8f255721daed28e658c5fe4a75fd924c3d078f0f8
SHA51208515b05fafae5959ee9648b16fd0c9cbce33456754f71605b2eee6af7fe5d47e8c47092b919f5bb0db54e1fbf07e797309c52f3b089ac81cc66fe04e1fc4a5f
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD549cf212053725ff4a22dd3ea18405f45
SHA1462fddce5cf25f6ea5c2451b7c47bd78b784049b
SHA256651d346daf9d7465a2c30f503302d9a86e52ee13a135958403869642a4abfcca
SHA5125419d5689a32bab6f3b14269e6f9d1c310f13def57c6feb885ffba9263297bfe13358179dc406e80385a633e65886fba86491dfe9d369922077c8b21f8ea0f87
-
Filesize
72KB
MD549cf212053725ff4a22dd3ea18405f45
SHA1462fddce5cf25f6ea5c2451b7c47bd78b784049b
SHA256651d346daf9d7465a2c30f503302d9a86e52ee13a135958403869642a4abfcca
SHA5125419d5689a32bab6f3b14269e6f9d1c310f13def57c6feb885ffba9263297bfe13358179dc406e80385a633e65886fba86491dfe9d369922077c8b21f8ea0f87
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296
-
Filesize
72KB
MD51e57aae7c08a823c9a5d01b01068caf7
SHA113ee5728a503156516606133d47b34e857af33b9
SHA256a3b94d9a89c3d6580414403a61bff958ce2303317612e741d89d766c83b11e57
SHA512d244daa814f7613ba267299f4fefad45e8e7ba9a7e1db613a876921bb3f4fb648ef4e9a1e2136c2bedd76dc270ea9f3366921bde3ca25af398f72d9ac3904296