Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12/10/2022, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe
Resource
win10v2004-20220901-en
General
-
Target
2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe
-
Size
72KB
-
MD5
6b2f531516bbdc04f025eeaf1a0e52f5
-
SHA1
8accd1daca2d1abcfad29bdf6e7043a4f02d5630
-
SHA256
2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4
-
SHA512
5584639808249e76423d5720b7ae00f3ec51b207accc4957730511de7c8c8f0e4697e1d043578e9e1d237679c0153a9a494e7aae9c9ed71b722f086355b09147
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2K:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr2
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2044 backup.exe 1744 backup.exe 1536 backup.exe 1056 backup.exe 584 backup.exe 700 backup.exe 1580 backup.exe 980 backup.exe 1832 backup.exe 1944 backup.exe 1960 backup.exe 1912 backup.exe 904 backup.exe 1852 backup.exe 1436 backup.exe 1772 backup.exe 1184 backup.exe 1736 backup.exe 552 backup.exe 688 backup.exe 532 backup.exe 1128 backup.exe 1596 backup.exe 1784 backup.exe 700 backup.exe 1848 data.exe 556 backup.exe 1632 backup.exe 1412 backup.exe 2016 backup.exe 1704 update.exe 872 backup.exe 1976 backup.exe 1752 backup.exe 1084 backup.exe 1984 backup.exe 1932 backup.exe 876 backup.exe 2000 backup.exe 936 backup.exe 1356 backup.exe 1836 backup.exe 1840 System Restore.exe 844 backup.exe 1464 backup.exe 268 backup.exe 552 backup.exe 1132 backup.exe 1524 backup.exe 1780 backup.exe 532 backup.exe 584 backup.exe 1416 update.exe 1672 backup.exe 988 backup.exe 556 backup.exe 304 backup.exe 1776 backup.exe 2016 update.exe 1980 backup.exe 2012 backup.exe 2020 backup.exe 1568 backup.exe 1368 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 980 backup.exe 980 backup.exe 1832 backup.exe 1832 backup.exe 980 backup.exe 980 backup.exe 1960 backup.exe 1960 backup.exe 1912 backup.exe 1912 backup.exe 1960 backup.exe 1960 backup.exe 1852 backup.exe 1852 backup.exe 1436 backup.exe 1436 backup.exe 1436 backup.exe 1436 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1184 backup.exe 1412 backup.exe 1412 backup.exe 1412 backup.exe 1704 update.exe 1704 update.exe 1704 update.exe 1412 backup.exe 1412 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Google\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\VideoLAN\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 2044 backup.exe 1744 backup.exe 1536 backup.exe 1056 backup.exe 584 backup.exe 700 backup.exe 1580 backup.exe 980 backup.exe 1832 backup.exe 1944 backup.exe 1960 backup.exe 1912 backup.exe 904 backup.exe 1852 backup.exe 1436 backup.exe 1772 backup.exe 1184 backup.exe 1736 backup.exe 552 backup.exe 688 backup.exe 532 backup.exe 1128 backup.exe 1596 backup.exe 1784 backup.exe 700 backup.exe 1848 data.exe 556 backup.exe 1632 backup.exe 1412 backup.exe 2016 backup.exe 1704 update.exe 872 backup.exe 1976 backup.exe 1752 backup.exe 1084 backup.exe 1984 backup.exe 876 backup.exe 1932 backup.exe 2000 backup.exe 936 backup.exe 1356 backup.exe 1836 backup.exe 844 backup.exe 1464 backup.exe 1840 System Restore.exe 552 backup.exe 268 backup.exe 1132 backup.exe 1524 backup.exe 1780 backup.exe 584 backup.exe 532 backup.exe 1672 backup.exe 1416 update.exe 556 backup.exe 304 backup.exe 988 backup.exe 1776 backup.exe 2012 backup.exe 1980 backup.exe 2016 update.exe 2020 backup.exe 1568 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 2044 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 27 PID 1344 wrote to memory of 2044 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 27 PID 1344 wrote to memory of 2044 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 27 PID 1344 wrote to memory of 2044 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 27 PID 1344 wrote to memory of 1744 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 28 PID 1344 wrote to memory of 1744 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 28 PID 1344 wrote to memory of 1744 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 28 PID 1344 wrote to memory of 1744 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 28 PID 1344 wrote to memory of 1536 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 29 PID 1344 wrote to memory of 1536 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 29 PID 1344 wrote to memory of 1536 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 29 PID 1344 wrote to memory of 1536 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 29 PID 1344 wrote to memory of 1056 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 30 PID 1344 wrote to memory of 1056 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 30 PID 1344 wrote to memory of 1056 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 30 PID 1344 wrote to memory of 1056 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 30 PID 1344 wrote to memory of 584 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 31 PID 1344 wrote to memory of 584 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 31 PID 1344 wrote to memory of 584 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 31 PID 1344 wrote to memory of 584 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 31 PID 1344 wrote to memory of 700 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 32 PID 1344 wrote to memory of 700 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 32 PID 1344 wrote to memory of 700 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 32 PID 1344 wrote to memory of 700 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 32 PID 1344 wrote to memory of 1580 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 33 PID 1344 wrote to memory of 1580 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 33 PID 1344 wrote to memory of 1580 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 33 PID 1344 wrote to memory of 1580 1344 2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe 33 PID 2044 wrote to memory of 980 2044 backup.exe 34 PID 2044 wrote to memory of 980 2044 backup.exe 34 PID 2044 wrote to memory of 980 2044 backup.exe 34 PID 2044 wrote to memory of 980 2044 backup.exe 34 PID 980 wrote to memory of 1832 980 backup.exe 35 PID 980 wrote to memory of 1832 980 backup.exe 35 PID 980 wrote to memory of 1832 980 backup.exe 35 PID 980 wrote to memory of 1832 980 backup.exe 35 PID 1832 wrote to memory of 1944 1832 backup.exe 36 PID 1832 wrote to memory of 1944 1832 backup.exe 36 PID 1832 wrote to memory of 1944 1832 backup.exe 36 PID 1832 wrote to memory of 1944 1832 backup.exe 36 PID 980 wrote to memory of 1960 980 backup.exe 37 PID 980 wrote to memory of 1960 980 backup.exe 37 PID 980 wrote to memory of 1960 980 backup.exe 37 PID 980 wrote to memory of 1960 980 backup.exe 37 PID 1960 wrote to memory of 1912 1960 backup.exe 38 PID 1960 wrote to memory of 1912 1960 backup.exe 38 PID 1960 wrote to memory of 1912 1960 backup.exe 38 PID 1960 wrote to memory of 1912 1960 backup.exe 38 PID 1912 wrote to memory of 904 1912 backup.exe 39 PID 1912 wrote to memory of 904 1912 backup.exe 39 PID 1912 wrote to memory of 904 1912 backup.exe 39 PID 1912 wrote to memory of 904 1912 backup.exe 39 PID 1960 wrote to memory of 1852 1960 backup.exe 40 PID 1960 wrote to memory of 1852 1960 backup.exe 40 PID 1960 wrote to memory of 1852 1960 backup.exe 40 PID 1960 wrote to memory of 1852 1960 backup.exe 40 PID 1852 wrote to memory of 1436 1852 backup.exe 41 PID 1852 wrote to memory of 1436 1852 backup.exe 41 PID 1852 wrote to memory of 1436 1852 backup.exe 41 PID 1852 wrote to memory of 1436 1852 backup.exe 41 PID 1436 wrote to memory of 1772 1436 backup.exe 42 PID 1436 wrote to memory of 1772 1436 backup.exe 42 PID 1436 wrote to memory of 1772 1436 backup.exe 42 PID 1436 wrote to memory of 1772 1436 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe"C:\Users\Admin\AppData\Local\Temp\2a648b0f1b1497569f16dc18cbb9e94ccc9715473faa6e4db17bccea0e5c62a4.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\2257166648\backup.exeC:\Users\Admin\AppData\Local\Temp\2257166648\backup.exe C:\Users\Admin\AppData\Local\Temp\2257166648\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:980 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1944
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:904
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1852 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1436 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1772
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1184 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1848
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1412 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:936
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:1512
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1192
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- System policy modification
PID:1412
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- System policy modification
PID:840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵PID:1124
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵PID:1988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:1852
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:2112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:2256
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1416 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:304
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
PID:344
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1732
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:556
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
PID:1844 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1568
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
PID:2036 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1032
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1420
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:1144
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1848
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Drops file in Windows directory
PID:980
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1524
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1672 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:1368 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1680 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
PID:268
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1944
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1984
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1668
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1520
-
-
-
C:\Program Files\Common Files\System\de-DE\update.exe"C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:700
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:988
-
-
C:\Program Files\Common Files\System\es-ES\data.exe"C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:2020
-
-
C:\Program Files\Common Files\System\fr-FR\System Restore.exe"C:\Program Files\Common Files\System\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1056
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Disables RegEdit via registry modification
PID:932
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:436
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:988
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1776
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1464 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:988
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
PID:1428
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1836
-
-
C:\Program Files\DVD Maker\Shared\update.exe"C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:588 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
PID:1376 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1660
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1752
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1420
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1124
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1524
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1256
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Modifies visibility of file extensions in Explorer
PID:1384
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1668
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:580
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:268
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:1528
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:956
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:2076
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:2148
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵PID:2284
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵PID:2384
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\8⤵PID:2456
-
-
-
-
-
C:\Program Files\Google\data.exe"C:\Program Files\Google\data.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1192 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Disables RegEdit via registry modification
PID:1752 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Disables RegEdit via registry modification
PID:1512 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:304 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:2448
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1128
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1680
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1932
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Modifies visibility of file extensions in Explorer
PID:1124
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2060
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2164
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2300
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2376
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2424
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:876 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1780
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:556
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2012
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1668
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:840
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
PID:288 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:836
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2012
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1300 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1788 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵PID:612
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1996 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:276
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:2000
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1524 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1468
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:340
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:904
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
- System policy modification
PID:556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Disables RegEdit via registry modification
PID:676 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1632
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2040
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1900
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1492
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2052
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1940
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:772 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1636 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1412
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Modifies visibility of file extensions in Explorer
PID:572 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:916 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵PID:2096
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:2028
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1660
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2020
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1992
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1008
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2156
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2308
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1428
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft Analysis Services\data.exe"C:\Program Files (x86)\Microsoft Analysis Services\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2440
-
-
-
C:\Users\update.exeC:\Users\update.exe C:\Users\4⤵PID:528
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:596 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1964
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
PID:460
-
-
C:\Users\Admin\Documents\System Restore.exe"C:\Users\Admin\Documents\System Restore.exe" C:\Users\Admin\Documents\6⤵
- System policy modification
PID:1724
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1100
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:332
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:1764
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2128
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:2264
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:2356
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:2432
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1520
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1372
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1056
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:700
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1580
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD52dd389b2b1f9cffe23d683c2e47b3290
SHA16e8d6b4811ffbec27fbf2781a266ecdf97c6c494
SHA25615dc822c301d4f90747b6ca519dbe3060dd8ba54ed8b81193d6c47dcc0589860
SHA5120cee1d7644c1edc72d04e4c411708477463c97e9b3d2cf21b65865a080ca2d674c960a64e1995812cc01824a04bcfdc1c28255c4bbf48499998764b3215268fc
-
Filesize
72KB
MD5a6760e20af1087d88d4e47c758e95f5a
SHA18a3688f272f5dec4fe4b58af9cf638f0097dcaac
SHA25691bae9d2ec42da15122a440ce71c5945c79d3aa32d0ef80e1f380fc7c6d6c039
SHA512e438b98a96f8486c15e482ad4f193c0cf26cbde589bc32d8c51fb0dc6bcb16770373653949038234468df47db2b9555769e5565705e191455f80fff6168651db
-
Filesize
72KB
MD5a6760e20af1087d88d4e47c758e95f5a
SHA18a3688f272f5dec4fe4b58af9cf638f0097dcaac
SHA25691bae9d2ec42da15122a440ce71c5945c79d3aa32d0ef80e1f380fc7c6d6c039
SHA512e438b98a96f8486c15e482ad4f193c0cf26cbde589bc32d8c51fb0dc6bcb16770373653949038234468df47db2b9555769e5565705e191455f80fff6168651db
-
Filesize
72KB
MD54322916a1a2384ab3a8b8c5684a4b66f
SHA11088c9161f22e9c6c9c8c8031e470288d65e46f4
SHA2563faa68d391d18f919f7747af0366905cff56bb3917e1cdc8ee73ca6693ed8fb1
SHA5127e2f7524dba896a2f0d0363af14cc0f863aee0555e6df923a25ed4cdebb9bd593f7173edf5b8f40e12cecdb0e40b83a763ed28e42d602f075659ff3b24403a56
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD554d14b4b6ecb928832a4bf3751b692e9
SHA19a26c531f5a2f3b9cd4afc099ad0d1433decf496
SHA2566b060ea5c593807723978f60573b2a59bab9c61b82cc6415ad5af378c359b803
SHA512140a7d0b3fc79dcae2a57dd04ae48dfc747fdc71f17cda215b189937d7faaa4ccac734f6cd3e05ea9a17af6d2a898e1574781bb229533b83c4ffc5eccb256f9b
-
Filesize
72KB
MD554d14b4b6ecb928832a4bf3751b692e9
SHA19a26c531f5a2f3b9cd4afc099ad0d1433decf496
SHA2566b060ea5c593807723978f60573b2a59bab9c61b82cc6415ad5af378c359b803
SHA512140a7d0b3fc79dcae2a57dd04ae48dfc747fdc71f17cda215b189937d7faaa4ccac734f6cd3e05ea9a17af6d2a898e1574781bb229533b83c4ffc5eccb256f9b
-
Filesize
72KB
MD531dfd9ff7731ef0ec2ed6906014d61c7
SHA1a8a3c0b666469631a822200e94d07acf984f55de
SHA25675838c4fa99fc2d6080d674c033c08f80a2cc337a7c3b117d822e54e1aaf87ae
SHA512214af4ce5a2267f2ec6e1c0c6e36c84b10a685a742c499a96b768d860fd7f1ade98c8b3520cc6dac3a3632df6b4baa8a21b5041a8c0157547a9ec45857277580
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD5c7a68c652f5d37d4cca827d7e3ba8f55
SHA1d3e2b90b87f42aaaeda523c94e312cff68852e20
SHA256a4cf4d850d5e8bba2cf0bd59ffad08dcf70df492d463e59a408da500e75955ae
SHA512ec36e19d7f5899268004923e55bdee1a86fdb0d2b04c2fe4569a3b43c8babf20d9b0d6fc178bf606a86810c944faf388565b1e983abab88444f6fe4edbbe6994
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD5b925e8aadffbee0ef57dc51aebba2f12
SHA1d816c0673df8284460390ae1f0d0f5ff3cf3973a
SHA256973837ee64d78acef4ffe3a5c7b11324576489b772e8637fcfc9205390d0fef0
SHA512858940200b4135421ac925412544a974fba23155be8b65367b45397895be96e89c8e8dd704e8ba748c72b8d4cade0acb1a79868f8ed35ff4212112eb56109d34
-
Filesize
72KB
MD5b925e8aadffbee0ef57dc51aebba2f12
SHA1d816c0673df8284460390ae1f0d0f5ff3cf3973a
SHA256973837ee64d78acef4ffe3a5c7b11324576489b772e8637fcfc9205390d0fef0
SHA512858940200b4135421ac925412544a974fba23155be8b65367b45397895be96e89c8e8dd704e8ba748c72b8d4cade0acb1a79868f8ed35ff4212112eb56109d34
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD58efa1777f5bebfd5463bc56290f5b109
SHA14c072cf6a65b3b051ef4041d0f3e65b2127eb6f9
SHA2569e7cb1a9ac94b5adadc4ad6d7a8b96a7da402ec225503ac23c845286dd564740
SHA5122bbe74adb5a2f776f7f4c63880654581278ec5034df49de74cf19e46e8c7809c26708a2a8ba5a07ac6ef226c5c6b58785a788ad9587981379a1386f5c4cc20ed
-
Filesize
72KB
MD58efa1777f5bebfd5463bc56290f5b109
SHA14c072cf6a65b3b051ef4041d0f3e65b2127eb6f9
SHA2569e7cb1a9ac94b5adadc4ad6d7a8b96a7da402ec225503ac23c845286dd564740
SHA5122bbe74adb5a2f776f7f4c63880654581278ec5034df49de74cf19e46e8c7809c26708a2a8ba5a07ac6ef226c5c6b58785a788ad9587981379a1386f5c4cc20ed
-
Filesize
72KB
MD52dd389b2b1f9cffe23d683c2e47b3290
SHA16e8d6b4811ffbec27fbf2781a266ecdf97c6c494
SHA25615dc822c301d4f90747b6ca519dbe3060dd8ba54ed8b81193d6c47dcc0589860
SHA5120cee1d7644c1edc72d04e4c411708477463c97e9b3d2cf21b65865a080ca2d674c960a64e1995812cc01824a04bcfdc1c28255c4bbf48499998764b3215268fc
-
Filesize
72KB
MD52dd389b2b1f9cffe23d683c2e47b3290
SHA16e8d6b4811ffbec27fbf2781a266ecdf97c6c494
SHA25615dc822c301d4f90747b6ca519dbe3060dd8ba54ed8b81193d6c47dcc0589860
SHA5120cee1d7644c1edc72d04e4c411708477463c97e9b3d2cf21b65865a080ca2d674c960a64e1995812cc01824a04bcfdc1c28255c4bbf48499998764b3215268fc
-
Filesize
72KB
MD5a6760e20af1087d88d4e47c758e95f5a
SHA18a3688f272f5dec4fe4b58af9cf638f0097dcaac
SHA25691bae9d2ec42da15122a440ce71c5945c79d3aa32d0ef80e1f380fc7c6d6c039
SHA512e438b98a96f8486c15e482ad4f193c0cf26cbde589bc32d8c51fb0dc6bcb16770373653949038234468df47db2b9555769e5565705e191455f80fff6168651db
-
Filesize
72KB
MD5a6760e20af1087d88d4e47c758e95f5a
SHA18a3688f272f5dec4fe4b58af9cf638f0097dcaac
SHA25691bae9d2ec42da15122a440ce71c5945c79d3aa32d0ef80e1f380fc7c6d6c039
SHA512e438b98a96f8486c15e482ad4f193c0cf26cbde589bc32d8c51fb0dc6bcb16770373653949038234468df47db2b9555769e5565705e191455f80fff6168651db
-
Filesize
72KB
MD54322916a1a2384ab3a8b8c5684a4b66f
SHA11088c9161f22e9c6c9c8c8031e470288d65e46f4
SHA2563faa68d391d18f919f7747af0366905cff56bb3917e1cdc8ee73ca6693ed8fb1
SHA5127e2f7524dba896a2f0d0363af14cc0f863aee0555e6df923a25ed4cdebb9bd593f7173edf5b8f40e12cecdb0e40b83a763ed28e42d602f075659ff3b24403a56
-
Filesize
72KB
MD54322916a1a2384ab3a8b8c5684a4b66f
SHA11088c9161f22e9c6c9c8c8031e470288d65e46f4
SHA2563faa68d391d18f919f7747af0366905cff56bb3917e1cdc8ee73ca6693ed8fb1
SHA5127e2f7524dba896a2f0d0363af14cc0f863aee0555e6df923a25ed4cdebb9bd593f7173edf5b8f40e12cecdb0e40b83a763ed28e42d602f075659ff3b24403a56
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD554d14b4b6ecb928832a4bf3751b692e9
SHA19a26c531f5a2f3b9cd4afc099ad0d1433decf496
SHA2566b060ea5c593807723978f60573b2a59bab9c61b82cc6415ad5af378c359b803
SHA512140a7d0b3fc79dcae2a57dd04ae48dfc747fdc71f17cda215b189937d7faaa4ccac734f6cd3e05ea9a17af6d2a898e1574781bb229533b83c4ffc5eccb256f9b
-
Filesize
72KB
MD554d14b4b6ecb928832a4bf3751b692e9
SHA19a26c531f5a2f3b9cd4afc099ad0d1433decf496
SHA2566b060ea5c593807723978f60573b2a59bab9c61b82cc6415ad5af378c359b803
SHA512140a7d0b3fc79dcae2a57dd04ae48dfc747fdc71f17cda215b189937d7faaa4ccac734f6cd3e05ea9a17af6d2a898e1574781bb229533b83c4ffc5eccb256f9b
-
Filesize
72KB
MD531dfd9ff7731ef0ec2ed6906014d61c7
SHA1a8a3c0b666469631a822200e94d07acf984f55de
SHA25675838c4fa99fc2d6080d674c033c08f80a2cc337a7c3b117d822e54e1aaf87ae
SHA512214af4ce5a2267f2ec6e1c0c6e36c84b10a685a742c499a96b768d860fd7f1ade98c8b3520cc6dac3a3632df6b4baa8a21b5041a8c0157547a9ec45857277580
-
Filesize
72KB
MD531dfd9ff7731ef0ec2ed6906014d61c7
SHA1a8a3c0b666469631a822200e94d07acf984f55de
SHA25675838c4fa99fc2d6080d674c033c08f80a2cc337a7c3b117d822e54e1aaf87ae
SHA512214af4ce5a2267f2ec6e1c0c6e36c84b10a685a742c499a96b768d860fd7f1ade98c8b3520cc6dac3a3632df6b4baa8a21b5041a8c0157547a9ec45857277580
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD5ec66ba3db056f5a9f91dd283f693aba8
SHA1161ac2bb4dc60395dac4100220d19406b9754277
SHA256b914f59d11bf321b95e9783816d9f03af0c98c024b9b346e5ae5586c8fe7a386
SHA51282bc56f0d41687b4b9081c3a87156e3f9c304e045d9ad8ebca65f5ec8d5f663878c51d2b5f39233a2b81b0bc8bc7137e5226a8b03d8e60c8ab46670a7a3ca1e9
-
Filesize
72KB
MD5c7a68c652f5d37d4cca827d7e3ba8f55
SHA1d3e2b90b87f42aaaeda523c94e312cff68852e20
SHA256a4cf4d850d5e8bba2cf0bd59ffad08dcf70df492d463e59a408da500e75955ae
SHA512ec36e19d7f5899268004923e55bdee1a86fdb0d2b04c2fe4569a3b43c8babf20d9b0d6fc178bf606a86810c944faf388565b1e983abab88444f6fe4edbbe6994
-
Filesize
72KB
MD5c7a68c652f5d37d4cca827d7e3ba8f55
SHA1d3e2b90b87f42aaaeda523c94e312cff68852e20
SHA256a4cf4d850d5e8bba2cf0bd59ffad08dcf70df492d463e59a408da500e75955ae
SHA512ec36e19d7f5899268004923e55bdee1a86fdb0d2b04c2fe4569a3b43c8babf20d9b0d6fc178bf606a86810c944faf388565b1e983abab88444f6fe4edbbe6994
-
Filesize
72KB
MD5c7a68c652f5d37d4cca827d7e3ba8f55
SHA1d3e2b90b87f42aaaeda523c94e312cff68852e20
SHA256a4cf4d850d5e8bba2cf0bd59ffad08dcf70df492d463e59a408da500e75955ae
SHA512ec36e19d7f5899268004923e55bdee1a86fdb0d2b04c2fe4569a3b43c8babf20d9b0d6fc178bf606a86810c944faf388565b1e983abab88444f6fe4edbbe6994
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD543f1796b379aef22312741fdbfe61afc
SHA1e1c78a31544fac4da0872bfd9166de76d9eb9811
SHA25605139f68d355960b77ce4388c651334e819a37afafc585fa0930b2c3539479a4
SHA5122c8b308fa71b7b21816d140ee9e6474333693963390f214840ad8e62c727f46cf1c6f252d50aef1f2598c9e1ea30fc60d5809aa09c3d86c2d4faf07ad43401a3
-
Filesize
72KB
MD5b925e8aadffbee0ef57dc51aebba2f12
SHA1d816c0673df8284460390ae1f0d0f5ff3cf3973a
SHA256973837ee64d78acef4ffe3a5c7b11324576489b772e8637fcfc9205390d0fef0
SHA512858940200b4135421ac925412544a974fba23155be8b65367b45397895be96e89c8e8dd704e8ba748c72b8d4cade0acb1a79868f8ed35ff4212112eb56109d34
-
Filesize
72KB
MD5b925e8aadffbee0ef57dc51aebba2f12
SHA1d816c0673df8284460390ae1f0d0f5ff3cf3973a
SHA256973837ee64d78acef4ffe3a5c7b11324576489b772e8637fcfc9205390d0fef0
SHA512858940200b4135421ac925412544a974fba23155be8b65367b45397895be96e89c8e8dd704e8ba748c72b8d4cade0acb1a79868f8ed35ff4212112eb56109d34
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8
-
Filesize
72KB
MD59bd741f429f84ed19eb4d827ed7d87ab
SHA1096a444a843f1d15bd2bd1687510be989a86d6af
SHA25648af660ef695b95cd2c29bff2f305817e51f0a3dc6e82703ad576a9a0b9af2ed
SHA512311b40ad9822561d28e7863a1209ba9960351a6fd681b6c54cf7968dc0ea439df7acb9269e65557d793c7ca6e1ef720049f18f3b749d38d732cbe6ddec4be9c8