Analysis
-
max time kernel
98s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe
Resource
win10v2004-20220812-en
General
-
Target
9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe
-
Size
72KB
-
MD5
4dc5f4f3ad1f32baea7faaa56118a52e
-
SHA1
6157b6e5cccc83fd401e8691f3b38b205e709113
-
SHA256
9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2
-
SHA512
0805f2a04f65c28dd9d1adb81d4158c6cb1d6d6153d48ee1c2b42092237a0132cd4d0dc4571346f2cfbcd9a743f78041613b124f564bb4ebcbae1c60bb5c5c45
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2+:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1296 backup.exe 1472 backup.exe 1080 backup.exe 2040 backup.exe 964 backup.exe 1336 backup.exe 1488 backup.exe 892 backup.exe 1040 backup.exe 676 backup.exe 1112 backup.exe 1400 backup.exe 1204 backup.exe 1952 backup.exe 1956 backup.exe 1464 backup.exe 1252 backup.exe 1696 backup.exe 760 backup.exe 1476 backup.exe 1468 backup.exe 2024 backup.exe 1796 backup.exe 988 System Restore.exe 1592 backup.exe 1704 backup.exe 684 backup.exe 816 backup.exe 1328 backup.exe 1736 backup.exe 576 backup.exe 1964 backup.exe 1040 data.exe 1352 backup.exe 1148 backup.exe 2012 backup.exe 288 backup.exe 2032 backup.exe 1576 backup.exe 672 backup.exe 936 backup.exe 1308 backup.exe 840 backup.exe 2044 backup.exe 1452 update.exe 1696 update.exe 964 backup.exe 1332 backup.exe 1336 backup.exe 1640 backup.exe 1488 backup.exe 896 backup.exe 1596 backup.exe 816 backup.exe 1368 backup.exe 968 backup.exe 1828 backup.exe 1712 backup.exe 556 backup.exe 2000 backup.exe 1736 backup.exe 2012 System Restore.exe 1540 backup.exe 2032 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 892 backup.exe 892 backup.exe 1040 backup.exe 1040 backup.exe 892 backup.exe 892 backup.exe 1112 backup.exe 1112 backup.exe 1400 backup.exe 1400 backup.exe 1112 backup.exe 1112 backup.exe 1952 backup.exe 1952 backup.exe 1956 backup.exe 1956 backup.exe 1956 backup.exe 1956 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1252 backup.exe 1328 backup.exe 1328 backup.exe 1328 backup.exe 1328 backup.exe 1328 backup.exe 1328 backup.exe 1328 backup.exe 1328 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe update.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 1296 backup.exe 1472 backup.exe 1080 backup.exe 2040 backup.exe 964 backup.exe 1336 backup.exe 1488 backup.exe 892 backup.exe 1040 backup.exe 676 backup.exe 1112 backup.exe 1400 backup.exe 1204 backup.exe 1952 backup.exe 1956 backup.exe 1464 backup.exe 1252 backup.exe 1696 backup.exe 760 backup.exe 1476 backup.exe 1468 backup.exe 2024 backup.exe 1796 backup.exe 988 System Restore.exe 1592 backup.exe 1704 backup.exe 684 backup.exe 816 backup.exe 1328 backup.exe 1736 backup.exe 576 backup.exe 1964 backup.exe 1040 data.exe 1352 backup.exe 1148 backup.exe 2012 backup.exe 288 backup.exe 2032 backup.exe 1576 backup.exe 672 backup.exe 936 backup.exe 1308 backup.exe 840 backup.exe 2044 backup.exe 1452 update.exe 1696 update.exe 1332 backup.exe 964 backup.exe 1336 backup.exe 1640 backup.exe 1488 backup.exe 896 backup.exe 1596 backup.exe 816 backup.exe 1712 backup.exe 2000 backup.exe 1828 backup.exe 1368 backup.exe 1736 backup.exe 968 backup.exe 556 backup.exe 2012 System Restore.exe 1540 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 1296 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 28 PID 1756 wrote to memory of 1296 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 28 PID 1756 wrote to memory of 1296 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 28 PID 1756 wrote to memory of 1296 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 28 PID 1756 wrote to memory of 1472 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 29 PID 1756 wrote to memory of 1472 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 29 PID 1756 wrote to memory of 1472 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 29 PID 1756 wrote to memory of 1472 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 29 PID 1756 wrote to memory of 1080 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 30 PID 1756 wrote to memory of 1080 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 30 PID 1756 wrote to memory of 1080 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 30 PID 1756 wrote to memory of 1080 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 30 PID 1756 wrote to memory of 2040 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 31 PID 1756 wrote to memory of 2040 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 31 PID 1756 wrote to memory of 2040 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 31 PID 1756 wrote to memory of 2040 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 31 PID 1756 wrote to memory of 964 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 32 PID 1756 wrote to memory of 964 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 32 PID 1756 wrote to memory of 964 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 32 PID 1756 wrote to memory of 964 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 32 PID 1756 wrote to memory of 1336 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 33 PID 1756 wrote to memory of 1336 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 33 PID 1756 wrote to memory of 1336 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 33 PID 1756 wrote to memory of 1336 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 33 PID 1756 wrote to memory of 1488 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 34 PID 1756 wrote to memory of 1488 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 34 PID 1756 wrote to memory of 1488 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 34 PID 1756 wrote to memory of 1488 1756 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe 34 PID 1296 wrote to memory of 892 1296 backup.exe 35 PID 1296 wrote to memory of 892 1296 backup.exe 35 PID 1296 wrote to memory of 892 1296 backup.exe 35 PID 1296 wrote to memory of 892 1296 backup.exe 35 PID 892 wrote to memory of 1040 892 backup.exe 36 PID 892 wrote to memory of 1040 892 backup.exe 36 PID 892 wrote to memory of 1040 892 backup.exe 36 PID 892 wrote to memory of 1040 892 backup.exe 36 PID 1040 wrote to memory of 676 1040 backup.exe 37 PID 1040 wrote to memory of 676 1040 backup.exe 37 PID 1040 wrote to memory of 676 1040 backup.exe 37 PID 1040 wrote to memory of 676 1040 backup.exe 37 PID 892 wrote to memory of 1112 892 backup.exe 38 PID 892 wrote to memory of 1112 892 backup.exe 38 PID 892 wrote to memory of 1112 892 backup.exe 38 PID 892 wrote to memory of 1112 892 backup.exe 38 PID 1112 wrote to memory of 1400 1112 backup.exe 39 PID 1112 wrote to memory of 1400 1112 backup.exe 39 PID 1112 wrote to memory of 1400 1112 backup.exe 39 PID 1112 wrote to memory of 1400 1112 backup.exe 39 PID 1400 wrote to memory of 1204 1400 backup.exe 40 PID 1400 wrote to memory of 1204 1400 backup.exe 40 PID 1400 wrote to memory of 1204 1400 backup.exe 40 PID 1400 wrote to memory of 1204 1400 backup.exe 40 PID 1112 wrote to memory of 1952 1112 backup.exe 41 PID 1112 wrote to memory of 1952 1112 backup.exe 41 PID 1112 wrote to memory of 1952 1112 backup.exe 41 PID 1112 wrote to memory of 1952 1112 backup.exe 41 PID 1952 wrote to memory of 1956 1952 backup.exe 42 PID 1952 wrote to memory of 1956 1952 backup.exe 42 PID 1952 wrote to memory of 1956 1952 backup.exe 42 PID 1952 wrote to memory of 1956 1952 backup.exe 42 PID 1956 wrote to memory of 1464 1956 backup.exe 43 PID 1956 wrote to memory of 1464 1956 backup.exe 43 PID 1956 wrote to memory of 1464 1956 backup.exe 43 PID 1956 wrote to memory of 1464 1956 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe"C:\Users\Admin\AppData\Local\Temp\9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\681251397\backup.exeC:\Users\Admin\AppData\Local\Temp\681251397\backup.exe C:\Users\Admin\AppData\Local\Temp\681251397\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1296 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:892 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:676
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1112 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1952 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1252 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1328 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1148
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:288
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:672
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Disables RegEdit via registry modification
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Disables RegEdit via registry modification
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵PID:276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:2152
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1712 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1232
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:596
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1576
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1128 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1068
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1212
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2160
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1576
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Drops file in Program Files directory
- System policy modification
PID:964
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1608 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1820 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
PID:660
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1284
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
PID:1108
-
-
C:\Program Files\Common Files\System\ado\fr-FR\data.exe"C:\Program Files\Common Files\System\ado\fr-FR\data.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1372
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1512
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:2076
-
-
-
C:\Program Files\Common Files\System\de-DE\update.exe"C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1328
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1468
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1700
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2200
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:816 -
C:\Program Files\DVD Maker\de-DE\System Restore.exe"C:\Program Files\DVD Maker\de-DE\System Restore.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:2032
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Disables RegEdit via registry modification
PID:1164
-
-
C:\Program Files\DVD Maker\fr-FR\data.exe"C:\Program Files\DVD Maker\fr-FR\data.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1668
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1396
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1212
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:2012 -
C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:836
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1484
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:468
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1500
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:2168
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:936 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:840 -
C:\Program Files (x86)\Adobe\Reader 9.0\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1452 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:964
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1332 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Disables RegEdit via registry modification
PID:1104
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
PID:1308
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1572
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1148
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:832
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:852
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:2216
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1368 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Disables RegEdit via registry modification
PID:1752 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1696
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1708
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1596 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1400
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1008 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- System policy modification
PID:1988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1668
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1576
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1624
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1900 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1212
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1536 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Drops file in Program Files directory
- System policy modification
PID:676 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\data.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\data.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Modifies visibility of file extensions in Explorer
PID:1464 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1600
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\update.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\update.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- Modifies visibility of file extensions in Explorer
PID:1380
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1084
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- Drops file in Program Files directory
PID:288 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵PID:1648
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:636
-
-
C:\Program Files (x86)\Common Files\microsoft shared\data.exe"C:\Program Files (x86)\Common Files\microsoft shared\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1040
-
C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\7⤵PID:2144
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1632
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2184
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:676
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2176
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:884 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1592
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:2000
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1700
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
PID:1072
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1400
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Disables RegEdit via registry modification
PID:848
-
-
C:\Users\Admin\Music\data.exeC:\Users\Admin\Music\data.exe C:\Users\Admin\Music\6⤵PID:1540
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:1592
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:1552
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:2192
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1308 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:760
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:848
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:2208
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:904
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD54c5ce552b519df6f7139c61198c6a3b3
SHA1a8940f5341c35fdd40f8d9ba87b5e751665db08b
SHA256e736a3722acb43fd5ddbfd71ff62558216a0530b1c77ac47f13835c3a576cb9c
SHA5128157e00d2f95fe2bbd8e10deaf8299be1b7480355a706c4bf8e475204bec5bd9b85a8b185e3786f3a606da4d120b5ec903ce82845d0834eab4129655d03bfe59
-
Filesize
72KB
MD5d1e3cd3d895a8c944535db069af295ed
SHA1aedf51bcd3bd10a297b57440e205e9740fc678dd
SHA256c0330ca313bb9e9ed357e1b3f17481a12e9139297c3e86e9f7add079b24f5de6
SHA512546ac992fc7665691039e5656224fcec293302a3b830e326cd55955665aec754e8df111e07e50bdfbe0f3934c9f9855abcc6f8475e75ca230aee86a2697d49b9
-
Filesize
72KB
MD5d1e3cd3d895a8c944535db069af295ed
SHA1aedf51bcd3bd10a297b57440e205e9740fc678dd
SHA256c0330ca313bb9e9ed357e1b3f17481a12e9139297c3e86e9f7add079b24f5de6
SHA512546ac992fc7665691039e5656224fcec293302a3b830e326cd55955665aec754e8df111e07e50bdfbe0f3934c9f9855abcc6f8475e75ca230aee86a2697d49b9
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD59a9e49aa21e5af8641dbbfea5eb8fd38
SHA11882626664a04ac2823ce32cfdfab2b5cc36c8e9
SHA256db0242deda57d29baba21eb9f6400dd626fd6d90f5a3177f033a358e07472ab6
SHA512e1682264abbb06b303f6fd52e7d356c823760cebdcb61fd779217e03e0dd59cacaabc117c59a2a88b89911e8897779832a59a2d978edc373ac932bbd1ba1299f
-
Filesize
72KB
MD59a9e49aa21e5af8641dbbfea5eb8fd38
SHA11882626664a04ac2823ce32cfdfab2b5cc36c8e9
SHA256db0242deda57d29baba21eb9f6400dd626fd6d90f5a3177f033a358e07472ab6
SHA512e1682264abbb06b303f6fd52e7d356c823760cebdcb61fd779217e03e0dd59cacaabc117c59a2a88b89911e8897779832a59a2d978edc373ac932bbd1ba1299f
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD5f021c00834b84b78c1b32d4170aa8f76
SHA125aec82510f8666a13092b6a10f5c4a5eb3414ef
SHA25629a90a431e5d087729c3b5266843993628fb2392cc0ff2ac9547ac4a2db71b73
SHA51227b8aa396c8717b0122359b5ec5fe30075295060aa7e3d9410d4324f41f6997927205d099616a3b339058a697171f390d50a7d6c14675b27099ff0ecd732f3f4
-
Filesize
72KB
MD5f021c00834b84b78c1b32d4170aa8f76
SHA125aec82510f8666a13092b6a10f5c4a5eb3414ef
SHA25629a90a431e5d087729c3b5266843993628fb2392cc0ff2ac9547ac4a2db71b73
SHA51227b8aa396c8717b0122359b5ec5fe30075295060aa7e3d9410d4324f41f6997927205d099616a3b339058a697171f390d50a7d6c14675b27099ff0ecd732f3f4
-
Filesize
72KB
MD54c5ce552b519df6f7139c61198c6a3b3
SHA1a8940f5341c35fdd40f8d9ba87b5e751665db08b
SHA256e736a3722acb43fd5ddbfd71ff62558216a0530b1c77ac47f13835c3a576cb9c
SHA5128157e00d2f95fe2bbd8e10deaf8299be1b7480355a706c4bf8e475204bec5bd9b85a8b185e3786f3a606da4d120b5ec903ce82845d0834eab4129655d03bfe59
-
Filesize
72KB
MD54c5ce552b519df6f7139c61198c6a3b3
SHA1a8940f5341c35fdd40f8d9ba87b5e751665db08b
SHA256e736a3722acb43fd5ddbfd71ff62558216a0530b1c77ac47f13835c3a576cb9c
SHA5128157e00d2f95fe2bbd8e10deaf8299be1b7480355a706c4bf8e475204bec5bd9b85a8b185e3786f3a606da4d120b5ec903ce82845d0834eab4129655d03bfe59
-
Filesize
72KB
MD5d1e3cd3d895a8c944535db069af295ed
SHA1aedf51bcd3bd10a297b57440e205e9740fc678dd
SHA256c0330ca313bb9e9ed357e1b3f17481a12e9139297c3e86e9f7add079b24f5de6
SHA512546ac992fc7665691039e5656224fcec293302a3b830e326cd55955665aec754e8df111e07e50bdfbe0f3934c9f9855abcc6f8475e75ca230aee86a2697d49b9
-
Filesize
72KB
MD5d1e3cd3d895a8c944535db069af295ed
SHA1aedf51bcd3bd10a297b57440e205e9740fc678dd
SHA256c0330ca313bb9e9ed357e1b3f17481a12e9139297c3e86e9f7add079b24f5de6
SHA512546ac992fc7665691039e5656224fcec293302a3b830e326cd55955665aec754e8df111e07e50bdfbe0f3934c9f9855abcc6f8475e75ca230aee86a2697d49b9
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5fec4e5d3104c32af6877b7f4730e5d89
SHA1b16c6cb130aac7894371d1d81607eb94e71fc027
SHA25677bb83a1275e814b2b0dbbb35380ebbcffa775579b7e969d85791b06aefba37b
SHA51287f85d3dd9342cb5588939e17c2c4e2f88e105c2fe22fb86b0e707902dfe7c005c2f5978e4a88089f13b6288da226e4890dae1cb60913e359cf3da7f751667c0
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD541d88dd3bfeaa25622ce1bb0eff6a157
SHA1b2506524a379dfc0d7e34a537acea32a49d6b470
SHA256105b12bc459ef82313e380a16c9aca014af2e8322f20c281759021b5ae162f58
SHA512bdac0ac434988c4259e95b02104163c011afc0ce67f9776b9a77a078546853b61777a413668aec2d7bdf87367dde7c0272035b0e97c89bd4f18aac3105af865c
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD5d39410f6ad7a3037e1f7aacd6a2afc34
SHA1ec561d5d966e88186a963b67cf63a47cbd796838
SHA2564374aed24892057d63c322b6d27b33e397289dbe1432386ea7357b85191c98bc
SHA512887661782642216cd38c40875d46a7664f7c07474698befd299aa9e2ada0848c4801b559f55b05d15dfef24c4d276a2037e5c102077cecae62c3a9817efa37bd
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD5e7e5ef62e47bcf5d19f45389e7571510
SHA1b46bcb718d68bac4494eeb59b6d253c123aa079d
SHA256ca8bb1751e5e08ade1b4865bef8d7daae2df94d8daa941fe713f8858eae98fe4
SHA512f2cc28774e9f34c038319b35c547a39cbf471e0350eb191f2c56573be746d12add56e3459a3de5b057b4494d90f991c777709dd9f625d33b8d83ab00c2cae194
-
Filesize
72KB
MD59a9e49aa21e5af8641dbbfea5eb8fd38
SHA11882626664a04ac2823ce32cfdfab2b5cc36c8e9
SHA256db0242deda57d29baba21eb9f6400dd626fd6d90f5a3177f033a358e07472ab6
SHA512e1682264abbb06b303f6fd52e7d356c823760cebdcb61fd779217e03e0dd59cacaabc117c59a2a88b89911e8897779832a59a2d978edc373ac932bbd1ba1299f
-
Filesize
72KB
MD59a9e49aa21e5af8641dbbfea5eb8fd38
SHA11882626664a04ac2823ce32cfdfab2b5cc36c8e9
SHA256db0242deda57d29baba21eb9f6400dd626fd6d90f5a3177f033a358e07472ab6
SHA512e1682264abbb06b303f6fd52e7d356c823760cebdcb61fd779217e03e0dd59cacaabc117c59a2a88b89911e8897779832a59a2d978edc373ac932bbd1ba1299f
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5
-
Filesize
72KB
MD533d6b1199743e34d9122293ef0e2a437
SHA12d253b7976ad5207f7d27da8f4e4fae84e9503d0
SHA25672e28a166bab03b716769faa900e9980cf3e634e6f2439384ca11c4c8f526ec2
SHA5121cfc59bf5e3a9bbc381a5a346a6f79dd94d5682d85c57ed9c4e3835a61e1c343f469221d5a8fcee917b527e6ab1262731698e8df3e18c07e59d60d429b7bdeb5