Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe
Resource
win10v2004-20220812-en
General
-
Target
a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe
-
Size
72KB
-
MD5
0f6f3922a83ff802876fa3a65d47eeae
-
SHA1
02a3e8532053e829e4754a55c5fa66e1f81e89e1
-
SHA256
a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3
-
SHA512
45274815499f177ca6663d7e4c1e7154bec0bc7d3d063f42e0f08dfb0dd1332e2966f926269215607044b3105d6ca1b84d62eaafc8240a371dbf47dbe0c9e543
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2a:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPO
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 60 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 59 IoCs
pid Process 1584 System Restore.exe 520 backup.exe 1696 backup.exe 1100 backup.exe 1484 backup.exe 1360 backup.exe 1324 backup.exe 1872 backup.exe 1476 backup.exe 2020 backup.exe 1404 backup.exe 556 backup.exe 316 update.exe 432 backup.exe 1944 backup.exe 1200 backup.exe 908 backup.exe 1060 backup.exe 1064 backup.exe 1660 backup.exe 1400 update.exe 872 backup.exe 1460 System Restore.exe 1616 backup.exe 1092 backup.exe 776 backup.exe 2032 backup.exe 1364 backup.exe 1380 backup.exe 924 backup.exe 1992 backup.exe 1004 backup.exe 956 backup.exe 628 backup.exe 668 System Restore.exe 1224 backup.exe 1520 backup.exe 1500 backup.exe 2024 backup.exe 748 backup.exe 108 backup.exe 1692 backup.exe 1492 backup.exe 1324 backup.exe 1600 backup.exe 1592 update.exe 1536 backup.exe 2040 backup.exe 872 backup.exe 2020 backup.exe 296 backup.exe 1304 backup.exe 1092 backup.exe 392 backup.exe 1376 backup.exe 764 backup.exe 1772 backup.exe 1952 backup.exe 972 System Restore.exe -
Loads dropped DLL 64 IoCs
pid Process 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1872 backup.exe 1872 backup.exe 1476 backup.exe 1476 backup.exe 1872 backup.exe 1872 backup.exe 1404 backup.exe 1404 backup.exe 556 backup.exe 316 update.exe 316 update.exe 316 update.exe 1404 backup.exe 1404 backup.exe 432 backup.exe 432 backup.exe 1944 backup.exe 1944 backup.exe 1944 backup.exe 1944 backup.exe 1872 backup.exe 1872 backup.exe 1060 backup.exe 1060 backup.exe 1920 backup.exe 1920 backup.exe 1064 backup.exe 1400 update.exe 1400 update.exe 1400 update.exe 1920 backup.exe 1920 backup.exe 1400 update.exe 1400 update.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe 1404 backup.exe 1920 backup.exe 1404 backup.exe 1920 backup.exe 432 backup.exe 432 backup.exe 1400 update.exe 1400 update.exe 2032 backup.exe 2032 backup.exe 2032 backup.exe 1920 backup.exe 432 backup.exe -
Drops file in Program Files directory 49 IoCs
description ioc Process File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe -
Suspicious use of SetWindowsHookEx 60 IoCs
pid Process 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 1584 System Restore.exe 520 backup.exe 1696 backup.exe 1100 backup.exe 1484 backup.exe 1360 backup.exe 1324 backup.exe 1872 backup.exe 1476 backup.exe 2020 backup.exe 1404 backup.exe 556 backup.exe 316 update.exe 432 backup.exe 1944 backup.exe 1200 backup.exe 268 backup.exe 1704 backup.exe 1716 backup.exe 1108 backup.exe 516 backup.exe 1780 backup.exe 1100 backup.exe 1860 backup.exe 1484 backup.exe 968 backup.exe 1060 backup.exe 1344 backup.exe 1920 backup.exe 1064 backup.exe 1660 backup.exe 1400 update.exe 872 backup.exe 1460 System Restore.exe 1616 backup.exe 776 backup.exe 1092 backup.exe 2032 backup.exe 1380 backup.exe 1992 backup.exe 924 backup.exe 956 backup.exe 1364 backup.exe 1004 backup.exe 1520 backup.exe 1500 backup.exe 668 System Restore.exe 1224 backup.exe 2024 backup.exe 748 backup.exe 628 backup.exe 1692 backup.exe 1324 backup.exe 1492 backup.exe 1592 update.exe 2040 backup.exe 1536 backup.exe 872 backup.exe 2020 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1584 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 27 PID 1752 wrote to memory of 1584 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 27 PID 1752 wrote to memory of 1584 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 27 PID 1752 wrote to memory of 1584 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 27 PID 1752 wrote to memory of 520 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 28 PID 1752 wrote to memory of 520 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 28 PID 1752 wrote to memory of 520 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 28 PID 1752 wrote to memory of 520 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 28 PID 1752 wrote to memory of 1696 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 29 PID 1752 wrote to memory of 1696 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 29 PID 1752 wrote to memory of 1696 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 29 PID 1752 wrote to memory of 1696 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 29 PID 1752 wrote to memory of 1100 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 30 PID 1752 wrote to memory of 1100 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 30 PID 1752 wrote to memory of 1100 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 30 PID 1752 wrote to memory of 1100 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 30 PID 1752 wrote to memory of 1484 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 31 PID 1752 wrote to memory of 1484 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 31 PID 1752 wrote to memory of 1484 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 31 PID 1752 wrote to memory of 1484 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 31 PID 1752 wrote to memory of 1360 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 32 PID 1752 wrote to memory of 1360 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 32 PID 1752 wrote to memory of 1360 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 32 PID 1752 wrote to memory of 1360 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 32 PID 1752 wrote to memory of 1324 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 33 PID 1752 wrote to memory of 1324 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 33 PID 1752 wrote to memory of 1324 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 33 PID 1752 wrote to memory of 1324 1752 a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe 33 PID 1584 wrote to memory of 1872 1584 System Restore.exe 34 PID 1584 wrote to memory of 1872 1584 System Restore.exe 34 PID 1584 wrote to memory of 1872 1584 System Restore.exe 34 PID 1584 wrote to memory of 1872 1584 System Restore.exe 34 PID 1872 wrote to memory of 1476 1872 backup.exe 35 PID 1872 wrote to memory of 1476 1872 backup.exe 35 PID 1872 wrote to memory of 1476 1872 backup.exe 35 PID 1872 wrote to memory of 1476 1872 backup.exe 35 PID 1476 wrote to memory of 2020 1476 backup.exe 36 PID 1476 wrote to memory of 2020 1476 backup.exe 36 PID 1476 wrote to memory of 2020 1476 backup.exe 36 PID 1476 wrote to memory of 2020 1476 backup.exe 36 PID 1872 wrote to memory of 1404 1872 backup.exe 37 PID 1872 wrote to memory of 1404 1872 backup.exe 37 PID 1872 wrote to memory of 1404 1872 backup.exe 37 PID 1872 wrote to memory of 1404 1872 backup.exe 37 PID 1404 wrote to memory of 556 1404 backup.exe 38 PID 1404 wrote to memory of 556 1404 backup.exe 38 PID 1404 wrote to memory of 556 1404 backup.exe 38 PID 1404 wrote to memory of 556 1404 backup.exe 38 PID 556 wrote to memory of 316 556 backup.exe 39 PID 556 wrote to memory of 316 556 backup.exe 39 PID 556 wrote to memory of 316 556 backup.exe 39 PID 556 wrote to memory of 316 556 backup.exe 39 PID 556 wrote to memory of 316 556 backup.exe 39 PID 556 wrote to memory of 316 556 backup.exe 39 PID 556 wrote to memory of 316 556 backup.exe 39 PID 1404 wrote to memory of 432 1404 backup.exe 40 PID 1404 wrote to memory of 432 1404 backup.exe 40 PID 1404 wrote to memory of 432 1404 backup.exe 40 PID 1404 wrote to memory of 432 1404 backup.exe 40 PID 432 wrote to memory of 1944 432 backup.exe 41 PID 432 wrote to memory of 1944 432 backup.exe 41 PID 432 wrote to memory of 1944 432 backup.exe 41 PID 432 wrote to memory of 1944 432 backup.exe 41 PID 1944 wrote to memory of 1200 1944 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe"C:\Users\Admin\AppData\Local\Temp\a4491f1f210cc85ea1d82d52e5782c2956df51f9fbc06f905b0e6117a521eaa3.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1203000648\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\1203000648\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\1203000648\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1584 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1476 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1404 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Program Files\7-Zip\Lang\update.exe"C:\Program Files\7-Zip\Lang\update.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:316
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:432 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1944 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:908 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1100
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1344
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1380
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
PID:1772
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:1880
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:852
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1248
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:2096
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:2232
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1004 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1520
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
PID:108
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:924
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Executes dropped EXE
PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:856
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1864
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:516
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2060
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:776
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1364
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵PID:1224
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
PID:1600
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1992
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1344
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1568
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1348
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:788
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1264
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1624
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2120
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵PID:1992
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1500
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:2024
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1536
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Executes dropped EXE
PID:392
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:684
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1308
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
PID:1304 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:628
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:768
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:836
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1740
-
-
C:\Program Files\Microsoft Office\System Restore.exe"C:\Program Files\Microsoft Office\System Restore.exe" C:\Program Files\Microsoft Office\5⤵PID:1056
-
-
C:\Program Files\Mozilla Firefox\update.exe"C:\Program Files\Mozilla Firefox\update.exe" C:\Program Files\Mozilla Firefox\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:1956
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2080
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2224
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1060 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064 -
C:\Program Files (x86)\Adobe\Reader 9.0\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1400 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1460
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:668
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1324 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:1592
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:872
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1952
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:1316
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:864
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1460
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Executes dropped EXE
PID:1952
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:1228
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:2192
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1716
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:2176
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:960
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Executes dropped EXE
PID:764 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1160
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1028
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
PID:1616 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:2284
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1372
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2088
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1776
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
PID:296 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1680
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1968
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:956
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1720
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe"C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2112
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2256
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1724
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:2216
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:604
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1456
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵PID:2128
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:572
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\update.exe"C:\Program Files (x86)\Microsoft Synchronization Services\update.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\System Restore.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\System Restore.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2240
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1092 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:268
-
-
C:\Users\Public\data.exeC:\Users\Public\data.exe C:\Users\Public\5⤵PID:2044
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1224
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1100
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a42eb0d79572b1ca3d16bf688956cb2f
SHA15924c7bc0d5296ec155a7f773efb88d074ea9f46
SHA256c26cfd1be049ebc785d8b2b934319ca9de873b5b9897d15f87dc7adff6d73479
SHA512a5c8119b227d11ab60798a7ab6a0de0926688c793ae04b69ad52eb59c1db6bd61bbf70edd1efae8e19ad26fa5126d1a53fb81dee3258efc051f3d74e5ca27b34
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD57040a06391fba054cac62e546ebbf8e4
SHA1bffc80720ba6f24fa2ee014d49fcc50b7cc834d1
SHA25666bb748120896f56eb9a1796fe3392a83767c1d6177f146828eb3bc3c8248df6
SHA51280ef19b97922490736a9e5613ac8a859b8ac6e12ae324a9741d0257e2d9cf5a36ced6f4ff2bbc84383c8115f4b58ed464efbb0e9c6c42b314db17d4514f9234d
-
Filesize
72KB
MD57040a06391fba054cac62e546ebbf8e4
SHA1bffc80720ba6f24fa2ee014d49fcc50b7cc834d1
SHA25666bb748120896f56eb9a1796fe3392a83767c1d6177f146828eb3bc3c8248df6
SHA51280ef19b97922490736a9e5613ac8a859b8ac6e12ae324a9741d0257e2d9cf5a36ced6f4ff2bbc84383c8115f4b58ed464efbb0e9c6c42b314db17d4514f9234d
-
Filesize
72KB
MD5a7b8768a5ec62919db13a04604f2a038
SHA1c3283b958d6db4f89b576e391e9edc43320b3322
SHA256a88e55bd6471fcbec7111b2d6f8dcbb5647b8f32b4248f40a3519adf15f3e618
SHA5129c93eadda234888cf71e9a18cad00a2af45ae55c78578cecd35498db048f67f1576991ca98dacdcf3174a895c119d77eedc04839c2555d9ac49f50efc0235aae
-
Filesize
72KB
MD5a7b8768a5ec62919db13a04604f2a038
SHA1c3283b958d6db4f89b576e391e9edc43320b3322
SHA256a88e55bd6471fcbec7111b2d6f8dcbb5647b8f32b4248f40a3519adf15f3e618
SHA5129c93eadda234888cf71e9a18cad00a2af45ae55c78578cecd35498db048f67f1576991ca98dacdcf3174a895c119d77eedc04839c2555d9ac49f50efc0235aae
-
Filesize
72KB
MD5b152c2a9d3e8e33dc15154eef5985c8c
SHA1008dd48017c3290fb874f1e0fb2163f5cd20b394
SHA25664094dbdacc845829e272fa58f4e732e1caee7deb7e76d899f34881a65693c9b
SHA512c9703c3425d4b89c80358c5104a909c2f5b087f9afdbd333b57b3927cf999dbe5d28233dca811bd1c2f760c0173edff90225b3a63f918daab3218d260d4129b0
-
Filesize
72KB
MD5b152c2a9d3e8e33dc15154eef5985c8c
SHA1008dd48017c3290fb874f1e0fb2163f5cd20b394
SHA25664094dbdacc845829e272fa58f4e732e1caee7deb7e76d899f34881a65693c9b
SHA512c9703c3425d4b89c80358c5104a909c2f5b087f9afdbd333b57b3927cf999dbe5d28233dca811bd1c2f760c0173edff90225b3a63f918daab3218d260d4129b0
-
Filesize
72KB
MD5b8f414edf07a2d7fd9840778ff77b6be
SHA1945a50d76ff9739e5cb63d027e2cd8bd04b587f5
SHA256aac913a76565370d16ec89356202602f53063571a1ee41e1685b0f22c995a553
SHA51230c783e10a3d70db266561747d75b45b467f261ad804ff85df10f44a55f88d6e2ffcc218f0e22fdd1dd5bb81a3873e65dacda40a9eb72f5846b1d0e1c5bbd768
-
Filesize
72KB
MD5fb3acbc4439bd21be924ce76cab95a79
SHA12c61f7b75e10829b8ecb82df26ae33d63cfa4232
SHA25603255e7caf8366d7fb989706acc745fc344c8d925c99fd329b3f1484fb258327
SHA512bf0fd473b3c9adf56c6bc239f3ba100055b835ed16a9bc42e6e931b2f2e88bb3982fa406b78658920928ab312393f9e3105168cbbf94d4be1ff7073f56573264
-
Filesize
72KB
MD5fb3acbc4439bd21be924ce76cab95a79
SHA12c61f7b75e10829b8ecb82df26ae33d63cfa4232
SHA25603255e7caf8366d7fb989706acc745fc344c8d925c99fd329b3f1484fb258327
SHA512bf0fd473b3c9adf56c6bc239f3ba100055b835ed16a9bc42e6e931b2f2e88bb3982fa406b78658920928ab312393f9e3105168cbbf94d4be1ff7073f56573264
-
Filesize
72KB
MD5b8f414edf07a2d7fd9840778ff77b6be
SHA1945a50d76ff9739e5cb63d027e2cd8bd04b587f5
SHA256aac913a76565370d16ec89356202602f53063571a1ee41e1685b0f22c995a553
SHA51230c783e10a3d70db266561747d75b45b467f261ad804ff85df10f44a55f88d6e2ffcc218f0e22fdd1dd5bb81a3873e65dacda40a9eb72f5846b1d0e1c5bbd768
-
Filesize
72KB
MD5ccb92c726b897f381faf8b1a5998d6bd
SHA10c4529a0635fa26ae9559d8c33240cbed80a7ff7
SHA2562f8504dec419a4f7ebab82b543ce5cef864dbc5bd96c598c076e3134f1d506fb
SHA512cbb9f611c1bdb54f97dcbefd46da910fc56f164a90c0b3b912d40b8a614beef6acaaf11e80f0f5db6bd63da7e06f63088cd212255fd2bb3f1ee7b28456f003b2
-
Filesize
72KB
MD5ccb92c726b897f381faf8b1a5998d6bd
SHA10c4529a0635fa26ae9559d8c33240cbed80a7ff7
SHA2562f8504dec419a4f7ebab82b543ce5cef864dbc5bd96c598c076e3134f1d506fb
SHA512cbb9f611c1bdb54f97dcbefd46da910fc56f164a90c0b3b912d40b8a614beef6acaaf11e80f0f5db6bd63da7e06f63088cd212255fd2bb3f1ee7b28456f003b2
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD5701272ef99624c73beebe2930ae1dee3
SHA170703e7d9a6a93a7945bfb4f91ceb69d8814c7df
SHA256049ef3f651efc84b74ce9ba5028131fecb19cc6cb24bf1ef0ed0813f5831aaac
SHA512fec0a5a8183c66ac4dcd1e6651d7f119aeb69e060aaf9312c6583d7b2d26cf20cf1b5e5e9cd5eed4e9a912f040db461111c3c7a37940019518d34e38ad68bdb7
-
Filesize
72KB
MD5701272ef99624c73beebe2930ae1dee3
SHA170703e7d9a6a93a7945bfb4f91ceb69d8814c7df
SHA256049ef3f651efc84b74ce9ba5028131fecb19cc6cb24bf1ef0ed0813f5831aaac
SHA512fec0a5a8183c66ac4dcd1e6651d7f119aeb69e060aaf9312c6583d7b2d26cf20cf1b5e5e9cd5eed4e9a912f040db461111c3c7a37940019518d34e38ad68bdb7
-
Filesize
72KB
MD5a42eb0d79572b1ca3d16bf688956cb2f
SHA15924c7bc0d5296ec155a7f773efb88d074ea9f46
SHA256c26cfd1be049ebc785d8b2b934319ca9de873b5b9897d15f87dc7adff6d73479
SHA512a5c8119b227d11ab60798a7ab6a0de0926688c793ae04b69ad52eb59c1db6bd61bbf70edd1efae8e19ad26fa5126d1a53fb81dee3258efc051f3d74e5ca27b34
-
Filesize
72KB
MD5a42eb0d79572b1ca3d16bf688956cb2f
SHA15924c7bc0d5296ec155a7f773efb88d074ea9f46
SHA256c26cfd1be049ebc785d8b2b934319ca9de873b5b9897d15f87dc7adff6d73479
SHA512a5c8119b227d11ab60798a7ab6a0de0926688c793ae04b69ad52eb59c1db6bd61bbf70edd1efae8e19ad26fa5126d1a53fb81dee3258efc051f3d74e5ca27b34
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD5720ef83804c0f93642d4be1cca670e48
SHA19c236ff992688fa3d6e3b91d35d4b3c1ce812320
SHA256a08e0c6bd85d246c113a84cd284f775fc83cdf76fe308a284234990ab32738ca
SHA51256807061e58b121839ee5ea6ec0511da5fba40c8548d5377e77beb39d751facc1dbe77d7249ee6bb0227db9d158ecd49f8071c24cdc88b3b9c7f284e7d940610
-
Filesize
72KB
MD57040a06391fba054cac62e546ebbf8e4
SHA1bffc80720ba6f24fa2ee014d49fcc50b7cc834d1
SHA25666bb748120896f56eb9a1796fe3392a83767c1d6177f146828eb3bc3c8248df6
SHA51280ef19b97922490736a9e5613ac8a859b8ac6e12ae324a9741d0257e2d9cf5a36ced6f4ff2bbc84383c8115f4b58ed464efbb0e9c6c42b314db17d4514f9234d
-
Filesize
72KB
MD57040a06391fba054cac62e546ebbf8e4
SHA1bffc80720ba6f24fa2ee014d49fcc50b7cc834d1
SHA25666bb748120896f56eb9a1796fe3392a83767c1d6177f146828eb3bc3c8248df6
SHA51280ef19b97922490736a9e5613ac8a859b8ac6e12ae324a9741d0257e2d9cf5a36ced6f4ff2bbc84383c8115f4b58ed464efbb0e9c6c42b314db17d4514f9234d
-
Filesize
72KB
MD5a7b8768a5ec62919db13a04604f2a038
SHA1c3283b958d6db4f89b576e391e9edc43320b3322
SHA256a88e55bd6471fcbec7111b2d6f8dcbb5647b8f32b4248f40a3519adf15f3e618
SHA5129c93eadda234888cf71e9a18cad00a2af45ae55c78578cecd35498db048f67f1576991ca98dacdcf3174a895c119d77eedc04839c2555d9ac49f50efc0235aae
-
Filesize
72KB
MD5a7b8768a5ec62919db13a04604f2a038
SHA1c3283b958d6db4f89b576e391e9edc43320b3322
SHA256a88e55bd6471fcbec7111b2d6f8dcbb5647b8f32b4248f40a3519adf15f3e618
SHA5129c93eadda234888cf71e9a18cad00a2af45ae55c78578cecd35498db048f67f1576991ca98dacdcf3174a895c119d77eedc04839c2555d9ac49f50efc0235aae
-
Filesize
72KB
MD5a7b8768a5ec62919db13a04604f2a038
SHA1c3283b958d6db4f89b576e391e9edc43320b3322
SHA256a88e55bd6471fcbec7111b2d6f8dcbb5647b8f32b4248f40a3519adf15f3e618
SHA5129c93eadda234888cf71e9a18cad00a2af45ae55c78578cecd35498db048f67f1576991ca98dacdcf3174a895c119d77eedc04839c2555d9ac49f50efc0235aae
-
Filesize
72KB
MD5a7b8768a5ec62919db13a04604f2a038
SHA1c3283b958d6db4f89b576e391e9edc43320b3322
SHA256a88e55bd6471fcbec7111b2d6f8dcbb5647b8f32b4248f40a3519adf15f3e618
SHA5129c93eadda234888cf71e9a18cad00a2af45ae55c78578cecd35498db048f67f1576991ca98dacdcf3174a895c119d77eedc04839c2555d9ac49f50efc0235aae
-
Filesize
72KB
MD5b152c2a9d3e8e33dc15154eef5985c8c
SHA1008dd48017c3290fb874f1e0fb2163f5cd20b394
SHA25664094dbdacc845829e272fa58f4e732e1caee7deb7e76d899f34881a65693c9b
SHA512c9703c3425d4b89c80358c5104a909c2f5b087f9afdbd333b57b3927cf999dbe5d28233dca811bd1c2f760c0173edff90225b3a63f918daab3218d260d4129b0
-
Filesize
72KB
MD5b152c2a9d3e8e33dc15154eef5985c8c
SHA1008dd48017c3290fb874f1e0fb2163f5cd20b394
SHA25664094dbdacc845829e272fa58f4e732e1caee7deb7e76d899f34881a65693c9b
SHA512c9703c3425d4b89c80358c5104a909c2f5b087f9afdbd333b57b3927cf999dbe5d28233dca811bd1c2f760c0173edff90225b3a63f918daab3218d260d4129b0
-
Filesize
72KB
MD5b8f414edf07a2d7fd9840778ff77b6be
SHA1945a50d76ff9739e5cb63d027e2cd8bd04b587f5
SHA256aac913a76565370d16ec89356202602f53063571a1ee41e1685b0f22c995a553
SHA51230c783e10a3d70db266561747d75b45b467f261ad804ff85df10f44a55f88d6e2ffcc218f0e22fdd1dd5bb81a3873e65dacda40a9eb72f5846b1d0e1c5bbd768
-
Filesize
72KB
MD5b8f414edf07a2d7fd9840778ff77b6be
SHA1945a50d76ff9739e5cb63d027e2cd8bd04b587f5
SHA256aac913a76565370d16ec89356202602f53063571a1ee41e1685b0f22c995a553
SHA51230c783e10a3d70db266561747d75b45b467f261ad804ff85df10f44a55f88d6e2ffcc218f0e22fdd1dd5bb81a3873e65dacda40a9eb72f5846b1d0e1c5bbd768
-
Filesize
72KB
MD5fb3acbc4439bd21be924ce76cab95a79
SHA12c61f7b75e10829b8ecb82df26ae33d63cfa4232
SHA25603255e7caf8366d7fb989706acc745fc344c8d925c99fd329b3f1484fb258327
SHA512bf0fd473b3c9adf56c6bc239f3ba100055b835ed16a9bc42e6e931b2f2e88bb3982fa406b78658920928ab312393f9e3105168cbbf94d4be1ff7073f56573264
-
Filesize
72KB
MD5fb3acbc4439bd21be924ce76cab95a79
SHA12c61f7b75e10829b8ecb82df26ae33d63cfa4232
SHA25603255e7caf8366d7fb989706acc745fc344c8d925c99fd329b3f1484fb258327
SHA512bf0fd473b3c9adf56c6bc239f3ba100055b835ed16a9bc42e6e931b2f2e88bb3982fa406b78658920928ab312393f9e3105168cbbf94d4be1ff7073f56573264
-
Filesize
72KB
MD5b8f414edf07a2d7fd9840778ff77b6be
SHA1945a50d76ff9739e5cb63d027e2cd8bd04b587f5
SHA256aac913a76565370d16ec89356202602f53063571a1ee41e1685b0f22c995a553
SHA51230c783e10a3d70db266561747d75b45b467f261ad804ff85df10f44a55f88d6e2ffcc218f0e22fdd1dd5bb81a3873e65dacda40a9eb72f5846b1d0e1c5bbd768
-
Filesize
72KB
MD5b8f414edf07a2d7fd9840778ff77b6be
SHA1945a50d76ff9739e5cb63d027e2cd8bd04b587f5
SHA256aac913a76565370d16ec89356202602f53063571a1ee41e1685b0f22c995a553
SHA51230c783e10a3d70db266561747d75b45b467f261ad804ff85df10f44a55f88d6e2ffcc218f0e22fdd1dd5bb81a3873e65dacda40a9eb72f5846b1d0e1c5bbd768
-
Filesize
72KB
MD5ccb92c726b897f381faf8b1a5998d6bd
SHA10c4529a0635fa26ae9559d8c33240cbed80a7ff7
SHA2562f8504dec419a4f7ebab82b543ce5cef864dbc5bd96c598c076e3134f1d506fb
SHA512cbb9f611c1bdb54f97dcbefd46da910fc56f164a90c0b3b912d40b8a614beef6acaaf11e80f0f5db6bd63da7e06f63088cd212255fd2bb3f1ee7b28456f003b2
-
Filesize
72KB
MD5ccb92c726b897f381faf8b1a5998d6bd
SHA10c4529a0635fa26ae9559d8c33240cbed80a7ff7
SHA2562f8504dec419a4f7ebab82b543ce5cef864dbc5bd96c598c076e3134f1d506fb
SHA512cbb9f611c1bdb54f97dcbefd46da910fc56f164a90c0b3b912d40b8a614beef6acaaf11e80f0f5db6bd63da7e06f63088cd212255fd2bb3f1ee7b28456f003b2
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD56edd9ad7f99e3382e58ee350e4e1acb7
SHA1b1803e12d8b94eb7ea2526908eec32aeb0823d2e
SHA256b19ace653b3b869070e2cad3947391af739976d9b1ec3e2230c21e138fa64185
SHA51290d567df059184fff5b1d778d1d01363766efecdf712138615f9c11ee1c7dbcd4d0cc780ce872591802cf2bc50b82c853beb32aefc490f30c800ed74e4e11043
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d
-
Filesize
72KB
MD518c7a27c4ddb4c60bb362f178e683019
SHA1ab6b503973dfd9bf49822c83f55721f9d66df492
SHA256861c847407a14063c15bafc20481643426d36a072f353cd22d88d6fa066a9b6f
SHA512b4d6a53d561ad6c705f9cc73cac79e5bae8b1d47baf3b44eaab950683f4c8c08cea85f68de38d3803df417026b2f936a108645dd0fed2c8bf3cd2d499f95221d