Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe
Resource
win10v2004-20220901-en
General
-
Target
4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe
-
Size
72KB
-
MD5
8086a199ad7e768f5abca1cf10bb39ff
-
SHA1
6948601c999fa8fd2a85830d4a0ea88483da4a1f
-
SHA256
4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13
-
SHA512
e4439bd7c6d21d10fd583e12c2539f3138eeef3ee94660c889006e9852b2f879b0ac4e050da96a8d2d5f091483646f79646398c2e04141879fe96684524d2938
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2y:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2000 System Restore.exe 1192 backup.exe 1116 backup.exe 2016 backup.exe 944 backup.exe 1964 backup.exe 1168 backup.exe 1516 backup.exe 1520 backup.exe 1988 backup.exe 560 backup.exe 1948 backup.exe 1492 backup.exe 1660 backup.exe 1164 backup.exe 1232 backup.exe 1940 backup.exe 336 backup.exe 1560 backup.exe 1316 System Restore.exe 616 backup.exe 1136 backup.exe 1776 update.exe 2028 backup.exe 920 backup.exe 1872 backup.exe 1992 backup.exe 1304 backup.exe 1808 backup.exe 1496 update.exe 1636 data.exe 1572 backup.exe 1876 backup.exe 1676 backup.exe 1952 backup.exe 2024 backup.exe 268 backup.exe 1392 System Restore.exe 1264 backup.exe 628 backup.exe 1064 backup.exe 924 update.exe 916 data.exe 1232 backup.exe 1648 backup.exe 1708 backup.exe 1752 backup.exe 1856 backup.exe 1052 backup.exe 1316 backup.exe 1108 backup.exe 2004 backup.exe 1776 backup.exe 2028 backup.exe 696 backup.exe 524 backup.exe 2012 backup.exe 1700 update.exe 1504 backup.exe 1388 update.exe 828 backup.exe 752 backup.exe 976 backup.exe 1392 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1168 backup.exe 1168 backup.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 1516 backup.exe 1516 backup.exe 1168 backup.exe 1168 backup.exe 560 backup.exe 560 backup.exe 1948 backup.exe 1948 backup.exe 560 backup.exe 560 backup.exe 1660 backup.exe 1660 backup.exe 1164 backup.exe 1164 backup.exe 1164 backup.exe 1164 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1776 update.exe 1776 update.exe 1776 update.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1940 backup.exe 1808 backup.exe 1496 update.exe 1496 update.exe 1496 update.exe 1168 backup.exe 1168 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe update.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\update.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\System Restore.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe update.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe data.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\data.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 2000 System Restore.exe 1192 backup.exe 1116 backup.exe 2016 backup.exe 944 backup.exe 1964 backup.exe 1168 backup.exe 1516 backup.exe 1520 backup.exe 1988 backup.exe 560 backup.exe 1948 backup.exe 1492 backup.exe 1660 backup.exe 1164 backup.exe 1232 backup.exe 1940 backup.exe 336 backup.exe 1560 backup.exe 1316 System Restore.exe 616 backup.exe 1136 backup.exe 1776 update.exe 2028 backup.exe 920 backup.exe 1872 backup.exe 1992 backup.exe 1304 backup.exe 1808 backup.exe 1496 update.exe 1636 data.exe 1572 backup.exe 1876 backup.exe 1676 backup.exe 1952 backup.exe 2024 backup.exe 268 backup.exe 1392 System Restore.exe 1264 backup.exe 628 backup.exe 1064 backup.exe 924 update.exe 916 data.exe 1232 backup.exe 1708 backup.exe 1648 backup.exe 1752 backup.exe 1856 backup.exe 1052 backup.exe 1316 backup.exe 1108 backup.exe 2004 backup.exe 1776 backup.exe 524 backup.exe 696 backup.exe 2012 backup.exe 2028 backup.exe 1700 update.exe 1504 backup.exe 1388 update.exe 828 backup.exe 752 backup.exe 976 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2000 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 26 PID 1976 wrote to memory of 2000 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 26 PID 1976 wrote to memory of 2000 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 26 PID 1976 wrote to memory of 2000 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 26 PID 1976 wrote to memory of 1192 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 27 PID 1976 wrote to memory of 1192 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 27 PID 1976 wrote to memory of 1192 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 27 PID 1976 wrote to memory of 1192 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 27 PID 1976 wrote to memory of 1116 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 28 PID 1976 wrote to memory of 1116 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 28 PID 1976 wrote to memory of 1116 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 28 PID 1976 wrote to memory of 1116 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 28 PID 1976 wrote to memory of 2016 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 29 PID 1976 wrote to memory of 2016 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 29 PID 1976 wrote to memory of 2016 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 29 PID 1976 wrote to memory of 2016 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 29 PID 1976 wrote to memory of 944 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 30 PID 1976 wrote to memory of 944 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 30 PID 1976 wrote to memory of 944 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 30 PID 1976 wrote to memory of 944 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 30 PID 1976 wrote to memory of 1964 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 31 PID 1976 wrote to memory of 1964 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 31 PID 1976 wrote to memory of 1964 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 31 PID 1976 wrote to memory of 1964 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 31 PID 2000 wrote to memory of 1168 2000 System Restore.exe 32 PID 2000 wrote to memory of 1168 2000 System Restore.exe 32 PID 2000 wrote to memory of 1168 2000 System Restore.exe 32 PID 2000 wrote to memory of 1168 2000 System Restore.exe 32 PID 1168 wrote to memory of 1516 1168 backup.exe 33 PID 1168 wrote to memory of 1516 1168 backup.exe 33 PID 1168 wrote to memory of 1516 1168 backup.exe 33 PID 1168 wrote to memory of 1516 1168 backup.exe 33 PID 1976 wrote to memory of 1520 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 34 PID 1976 wrote to memory of 1520 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 34 PID 1976 wrote to memory of 1520 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 34 PID 1976 wrote to memory of 1520 1976 4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe 34 PID 1516 wrote to memory of 1988 1516 backup.exe 35 PID 1516 wrote to memory of 1988 1516 backup.exe 35 PID 1516 wrote to memory of 1988 1516 backup.exe 35 PID 1516 wrote to memory of 1988 1516 backup.exe 35 PID 1168 wrote to memory of 560 1168 backup.exe 36 PID 1168 wrote to memory of 560 1168 backup.exe 36 PID 1168 wrote to memory of 560 1168 backup.exe 36 PID 1168 wrote to memory of 560 1168 backup.exe 36 PID 560 wrote to memory of 1948 560 backup.exe 37 PID 560 wrote to memory of 1948 560 backup.exe 37 PID 560 wrote to memory of 1948 560 backup.exe 37 PID 560 wrote to memory of 1948 560 backup.exe 37 PID 1948 wrote to memory of 1492 1948 backup.exe 38 PID 1948 wrote to memory of 1492 1948 backup.exe 38 PID 1948 wrote to memory of 1492 1948 backup.exe 38 PID 1948 wrote to memory of 1492 1948 backup.exe 38 PID 560 wrote to memory of 1660 560 backup.exe 39 PID 560 wrote to memory of 1660 560 backup.exe 39 PID 560 wrote to memory of 1660 560 backup.exe 39 PID 560 wrote to memory of 1660 560 backup.exe 39 PID 1660 wrote to memory of 1164 1660 backup.exe 40 PID 1660 wrote to memory of 1164 1660 backup.exe 40 PID 1660 wrote to memory of 1164 1660 backup.exe 40 PID 1660 wrote to memory of 1164 1660 backup.exe 40 PID 1164 wrote to memory of 1232 1164 backup.exe 41 PID 1164 wrote to memory of 1232 1164 backup.exe 41 PID 1164 wrote to memory of 1232 1164 backup.exe 41 PID 1164 wrote to memory of 1232 1164 backup.exe 41 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe"C:\Users\Admin\AppData\Local\Temp\4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\2910522919\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2000 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1168 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1516 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1940 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1304
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1808 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1676
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1152
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
PID:1084
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:436
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:1444
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:1112
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:524 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1816
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1180
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:336
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- System policy modification
PID:1676
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1320
-
-
-
C:\Program Files\Common Files\Services\System Restore.exe"C:\Program Files\Common Files\Services\System Restore.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1392
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1264 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1232
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1052 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:696 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:752
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1392
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
PID:584
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1840
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1720
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2032
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:912
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1984
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1580
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1316
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1964
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1312
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1504
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1432
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:268 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064
-
-
C:\Program Files\DVD Maker\en-US\data.exe"C:\Program Files\DVD Maker\en-US\data.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:916
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1108
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1776 -
C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:828
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:384
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1232
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1768
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:944
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1536
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1960
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1452
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:1232
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:2036
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:1620
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:996
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:1192
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵PID:2104
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1744
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:840
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1560
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1216
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:320
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1588
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:828
-
-
C:\Program Files\Reference Assemblies\System Restore.exe"C:\Program Files\Reference Assemblies\System Restore.exe" C:\Program Files\Reference Assemblies\5⤵PID:596
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2064
-
-
-
C:\Program Files (x86)\data.exe"C:\Program Files (x86)\data.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1636 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:924 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1388
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1512 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Disables RegEdit via registry modification
PID:1668
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
PID:1576
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1856 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Disables RegEdit via registry modification
PID:1772
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1368
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1464
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1616
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:988
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1304
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1728
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:112
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1268 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1176
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:2096
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1968
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Drops file in Program Files directory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:904
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:1568
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:1660
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:1196
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2072
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1980 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1048
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1512
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:1364 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:268
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1648
-
-
C:\Windows\AppPatch\data.exeC:\Windows\AppPatch\data.exe C:\Windows\AppPatch\5⤵PID:1672
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:920
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD52d3012d62421ae54f37319c90a265b33
SHA1fe165777eed3206cd8bd590c2b750d8841186391
SHA2564a51d82c9422075d5c99695f7dac45611cb3ab6bc17b66db273bc7413f037b6a
SHA5124620c90f6a67caf727b8e2827e6cc5951171264bedd36a87e7c080487918c1d1ec7c2b7c8d5f1441d286e60c030a44f0c7e82419192a3c57e2e9f1e232f3b6fd
-
Filesize
72KB
MD530f3f0662f594b426bc253a2a63472f3
SHA18dca41a248e74813bf7dd405b052880bac23d998
SHA256720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114
SHA5127692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e
-
Filesize
72KB
MD530f3f0662f594b426bc253a2a63472f3
SHA18dca41a248e74813bf7dd405b052880bac23d998
SHA256720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114
SHA5127692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e
-
Filesize
72KB
MD5ca604046794847c97baab2c854f98b44
SHA15d0b86028f6e3adb451b48753e765117b005b84a
SHA25659b032d9c5ade3b8a693e04cfb51f72ef43c95fb2cd24fe246428b492ddb6237
SHA512493d4288ec53f28d4200dbd478e82c4cb178c0865f7dfc20c220635d373a336ed81029fc761a9bdd5d54da42d7051a13168bf04c2bbb5685e927c009a27c5e1d
-
Filesize
72KB
MD5529638016d16cc16bea4145c5fd8a59f
SHA1b42011d3e717049a9825c1d2141ef2dd20dc4e77
SHA256dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101
SHA51238a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148
-
Filesize
72KB
MD5529638016d16cc16bea4145c5fd8a59f
SHA1b42011d3e717049a9825c1d2141ef2dd20dc4e77
SHA256dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101
SHA51238a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148
-
Filesize
72KB
MD5bf7cc94b0772847719b0f4a9b149418f
SHA1ac5ab6aa0ebaaf8a6e6c57492d1e6223541803f0
SHA25633f66dc8635701903497e9d01211367be5d4eafde77db7f69f4ca154fa79efc8
SHA512aeecdc1faf8a744f3271f565777b1aa46235df8874f0279e237688a8a0ddff541278e1820247ecc26fd7b86ca980c8d4cd4dc619309ddee724bb986b473877cb
-
Filesize
72KB
MD5322c8beed2a0e6b561977231813b822a
SHA1debe222c958cf11c6c0612e6c0af39f934d909bc
SHA2560698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536
SHA51273ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b
-
Filesize
72KB
MD5322c8beed2a0e6b561977231813b822a
SHA1debe222c958cf11c6c0612e6c0af39f934d909bc
SHA2560698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536
SHA51273ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b
-
Filesize
72KB
MD517e00708f76dc190fdc841300664a92a
SHA10730165d9fce716eb7748e88db65506d98cbf0ce
SHA25610085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a
SHA512538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219
-
Filesize
72KB
MD5d26661aa2a4636e1d31a4a22aebe557e
SHA14a8f128b6f03085ed001ffbb010b1555c59c7cfa
SHA256c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85
SHA5123830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185
-
Filesize
72KB
MD5d26661aa2a4636e1d31a4a22aebe557e
SHA14a8f128b6f03085ed001ffbb010b1555c59c7cfa
SHA256c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85
SHA5123830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185
-
Filesize
72KB
MD517e00708f76dc190fdc841300664a92a
SHA10730165d9fce716eb7748e88db65506d98cbf0ce
SHA25610085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a
SHA512538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219
-
Filesize
72KB
MD5bf168746d3f31d8a5736a9dca03d615a
SHA1997231c8af098669857d202877e0693c997983eb
SHA256c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f
SHA5123783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0
-
Filesize
72KB
MD5bf168746d3f31d8a5736a9dca03d615a
SHA1997231c8af098669857d202877e0693c997983eb
SHA256c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f
SHA5123783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0
-
Filesize
72KB
MD5cf548b065e5d8458d6587c84967b00f0
SHA1735fa5e2898d68fd8a8e2a5d31f41cd5305956ec
SHA2561d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144
SHA512615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1
-
Filesize
72KB
MD5cf548b065e5d8458d6587c84967b00f0
SHA1735fa5e2898d68fd8a8e2a5d31f41cd5305956ec
SHA2561d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144
SHA512615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD508f59b266367e8fb8e0f2fa79f406d9a
SHA1c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa
SHA25689c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93
SHA512a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD508f59b266367e8fb8e0f2fa79f406d9a
SHA1c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa
SHA25689c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93
SHA512a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3
-
Filesize
72KB
MD50e11d779e02232a95ee57644a11f6c8d
SHA1c15f12dfc793371dc47cf474c17f7b7faa5dc907
SHA2569226b277f75bbb2ab6ee4407ca1f642e99b1a0826e6c966404e02d470941dc8c
SHA512cc7e600a6ead43889648ad017f79026130b5106f71f9fdac816210802badc64ec686f95689e76f89f8c03c4b5b22ffe8871b35685e3edf1c79faa0c099db1e65
-
Filesize
72KB
MD50e11d779e02232a95ee57644a11f6c8d
SHA1c15f12dfc793371dc47cf474c17f7b7faa5dc907
SHA2569226b277f75bbb2ab6ee4407ca1f642e99b1a0826e6c966404e02d470941dc8c
SHA512cc7e600a6ead43889648ad017f79026130b5106f71f9fdac816210802badc64ec686f95689e76f89f8c03c4b5b22ffe8871b35685e3edf1c79faa0c099db1e65
-
Filesize
72KB
MD52d3012d62421ae54f37319c90a265b33
SHA1fe165777eed3206cd8bd590c2b750d8841186391
SHA2564a51d82c9422075d5c99695f7dac45611cb3ab6bc17b66db273bc7413f037b6a
SHA5124620c90f6a67caf727b8e2827e6cc5951171264bedd36a87e7c080487918c1d1ec7c2b7c8d5f1441d286e60c030a44f0c7e82419192a3c57e2e9f1e232f3b6fd
-
Filesize
72KB
MD52d3012d62421ae54f37319c90a265b33
SHA1fe165777eed3206cd8bd590c2b750d8841186391
SHA2564a51d82c9422075d5c99695f7dac45611cb3ab6bc17b66db273bc7413f037b6a
SHA5124620c90f6a67caf727b8e2827e6cc5951171264bedd36a87e7c080487918c1d1ec7c2b7c8d5f1441d286e60c030a44f0c7e82419192a3c57e2e9f1e232f3b6fd
-
Filesize
72KB
MD530f3f0662f594b426bc253a2a63472f3
SHA18dca41a248e74813bf7dd405b052880bac23d998
SHA256720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114
SHA5127692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e
-
Filesize
72KB
MD530f3f0662f594b426bc253a2a63472f3
SHA18dca41a248e74813bf7dd405b052880bac23d998
SHA256720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114
SHA5127692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e
-
Filesize
72KB
MD5ca604046794847c97baab2c854f98b44
SHA15d0b86028f6e3adb451b48753e765117b005b84a
SHA25659b032d9c5ade3b8a693e04cfb51f72ef43c95fb2cd24fe246428b492ddb6237
SHA512493d4288ec53f28d4200dbd478e82c4cb178c0865f7dfc20c220635d373a336ed81029fc761a9bdd5d54da42d7051a13168bf04c2bbb5685e927c009a27c5e1d
-
Filesize
72KB
MD5ca604046794847c97baab2c854f98b44
SHA15d0b86028f6e3adb451b48753e765117b005b84a
SHA25659b032d9c5ade3b8a693e04cfb51f72ef43c95fb2cd24fe246428b492ddb6237
SHA512493d4288ec53f28d4200dbd478e82c4cb178c0865f7dfc20c220635d373a336ed81029fc761a9bdd5d54da42d7051a13168bf04c2bbb5685e927c009a27c5e1d
-
Filesize
72KB
MD5529638016d16cc16bea4145c5fd8a59f
SHA1b42011d3e717049a9825c1d2141ef2dd20dc4e77
SHA256dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101
SHA51238a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148
-
Filesize
72KB
MD5529638016d16cc16bea4145c5fd8a59f
SHA1b42011d3e717049a9825c1d2141ef2dd20dc4e77
SHA256dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101
SHA51238a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148
-
Filesize
72KB
MD5bf7cc94b0772847719b0f4a9b149418f
SHA1ac5ab6aa0ebaaf8a6e6c57492d1e6223541803f0
SHA25633f66dc8635701903497e9d01211367be5d4eafde77db7f69f4ca154fa79efc8
SHA512aeecdc1faf8a744f3271f565777b1aa46235df8874f0279e237688a8a0ddff541278e1820247ecc26fd7b86ca980c8d4cd4dc619309ddee724bb986b473877cb
-
Filesize
72KB
MD5bf7cc94b0772847719b0f4a9b149418f
SHA1ac5ab6aa0ebaaf8a6e6c57492d1e6223541803f0
SHA25633f66dc8635701903497e9d01211367be5d4eafde77db7f69f4ca154fa79efc8
SHA512aeecdc1faf8a744f3271f565777b1aa46235df8874f0279e237688a8a0ddff541278e1820247ecc26fd7b86ca980c8d4cd4dc619309ddee724bb986b473877cb
-
Filesize
72KB
MD5322c8beed2a0e6b561977231813b822a
SHA1debe222c958cf11c6c0612e6c0af39f934d909bc
SHA2560698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536
SHA51273ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b
-
Filesize
72KB
MD5322c8beed2a0e6b561977231813b822a
SHA1debe222c958cf11c6c0612e6c0af39f934d909bc
SHA2560698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536
SHA51273ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b
-
Filesize
72KB
MD517e00708f76dc190fdc841300664a92a
SHA10730165d9fce716eb7748e88db65506d98cbf0ce
SHA25610085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a
SHA512538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219
-
Filesize
72KB
MD517e00708f76dc190fdc841300664a92a
SHA10730165d9fce716eb7748e88db65506d98cbf0ce
SHA25610085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a
SHA512538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219
-
Filesize
72KB
MD5d26661aa2a4636e1d31a4a22aebe557e
SHA14a8f128b6f03085ed001ffbb010b1555c59c7cfa
SHA256c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85
SHA5123830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185
-
Filesize
72KB
MD5d26661aa2a4636e1d31a4a22aebe557e
SHA14a8f128b6f03085ed001ffbb010b1555c59c7cfa
SHA256c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85
SHA5123830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185
-
Filesize
72KB
MD517e00708f76dc190fdc841300664a92a
SHA10730165d9fce716eb7748e88db65506d98cbf0ce
SHA25610085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a
SHA512538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219
-
Filesize
72KB
MD517e00708f76dc190fdc841300664a92a
SHA10730165d9fce716eb7748e88db65506d98cbf0ce
SHA25610085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a
SHA512538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219
-
Filesize
72KB
MD57fd0bc21a33a9a35435bd1560fac65c0
SHA1693ec4febb94683ee128634688ab5ed23cb5ac40
SHA256e64b567e8e3a0963747cd6b354ba3dbdeb848849a55f29fae19024d36a8b3589
SHA5124e7d4b38943616c813dd75d9f3b73e49dec1c22ccdd5e87e8db3cc0b940a52cec816dfd92e2bb7a05b61050dfa934f0262e116d5ac08bb1df2d37a95b9b6e8f1
-
Filesize
72KB
MD5bf168746d3f31d8a5736a9dca03d615a
SHA1997231c8af098669857d202877e0693c997983eb
SHA256c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f
SHA5123783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0
-
Filesize
72KB
MD5bf168746d3f31d8a5736a9dca03d615a
SHA1997231c8af098669857d202877e0693c997983eb
SHA256c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f
SHA5123783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0
-
Filesize
72KB
MD5cf548b065e5d8458d6587c84967b00f0
SHA1735fa5e2898d68fd8a8e2a5d31f41cd5305956ec
SHA2561d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144
SHA512615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1
-
Filesize
72KB
MD5cf548b065e5d8458d6587c84967b00f0
SHA1735fa5e2898d68fd8a8e2a5d31f41cd5305956ec
SHA2561d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144
SHA512615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD508f59b266367e8fb8e0f2fa79f406d9a
SHA1c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa
SHA25689c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93
SHA512a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3
-
Filesize
72KB
MD508f59b266367e8fb8e0f2fa79f406d9a
SHA1c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa
SHA25689c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93
SHA512a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD546d5a56ac778b430d9158266c27e0e3b
SHA165aa9c3845f9521428143622f565a4fddc4d834b
SHA256ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b
SHA5129cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a
-
Filesize
72KB
MD508f59b266367e8fb8e0f2fa79f406d9a
SHA1c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa
SHA25689c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93
SHA512a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3
-
Filesize
72KB
MD508f59b266367e8fb8e0f2fa79f406d9a
SHA1c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa
SHA25689c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93
SHA512a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3