Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe
Resource
win10v2004-20220812-en
General
-
Target
181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe
-
Size
72KB
-
MD5
0cd4a736b9016f93262eb1be23b6f27b
-
SHA1
b69800d2d0978855a370404dbad320c2f923fb6c
-
SHA256
181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e
-
SHA512
cf4b5e90866415b88a50100629d63c1b15c7bb637f110dba2977f69e288e75d3880831642c0b14ae2a805a28795f04c24f15efeac983e9d86b9364e3d9c5ef97
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf21:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr5
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe -
Executes dropped EXE 64 IoCs
pid Process 5112 backup.exe 964 backup.exe 3496 backup.exe 392 backup.exe 4668 backup.exe 3376 backup.exe 1356 backup.exe 3028 backup.exe 1460 backup.exe 2356 backup.exe 1140 backup.exe 4152 backup.exe 3540 backup.exe 3808 backup.exe 4496 backup.exe 4100 backup.exe 2888 backup.exe 3156 backup.exe 3112 backup.exe 1432 backup.exe 1044 backup.exe 4476 backup.exe 3820 backup.exe 4804 backup.exe 1924 backup.exe 3940 backup.exe 4956 backup.exe 4308 backup.exe 1896 backup.exe 2248 backup.exe 960 backup.exe 5060 backup.exe 2760 backup.exe 2936 backup.exe 1612 backup.exe 4416 data.exe 4160 backup.exe 1832 backup.exe 1640 backup.exe 1776 backup.exe 2580 backup.exe 2660 data.exe 4412 backup.exe 4824 backup.exe 4000 backup.exe 4680 data.exe 1500 backup.exe 4780 backup.exe 4512 backup.exe 2636 backup.exe 5084 backup.exe 5020 backup.exe 1236 backup.exe 4408 backup.exe 632 backup.exe 3548 backup.exe 4864 backup.exe 2004 backup.exe 1956 System Restore.exe 3028 backup.exe 3740 backup.exe 2424 backup.exe 2036 backup.exe 240 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe data.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe backup.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\update.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\data.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\backup.exe data.exe File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 5112 backup.exe 964 backup.exe 3496 backup.exe 392 backup.exe 4668 backup.exe 3376 backup.exe 1356 backup.exe 3028 backup.exe 1460 backup.exe 2356 backup.exe 1140 backup.exe 4152 backup.exe 3540 backup.exe 3808 backup.exe 4496 backup.exe 4100 backup.exe 3156 backup.exe 2888 backup.exe 3112 backup.exe 1432 backup.exe 1044 backup.exe 4476 backup.exe 4804 backup.exe 3820 backup.exe 1924 backup.exe 4956 backup.exe 3940 backup.exe 4308 backup.exe 1896 backup.exe 2248 backup.exe 960 backup.exe 5060 backup.exe 2760 backup.exe 2936 backup.exe 1612 backup.exe 4416 data.exe 4160 backup.exe 1832 backup.exe 1640 backup.exe 2580 backup.exe 1776 backup.exe 2660 data.exe 4412 backup.exe 4824 backup.exe 4000 backup.exe 4680 data.exe 1500 backup.exe 4780 backup.exe 4512 backup.exe 2636 backup.exe 5084 backup.exe 5020 backup.exe 1236 backup.exe 4408 backup.exe 632 backup.exe 3548 backup.exe 2004 backup.exe 1956 System Restore.exe 4864 backup.exe 3028 backup.exe 3740 backup.exe 2036 backup.exe 2424 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 5112 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 83 PID 628 wrote to memory of 5112 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 83 PID 628 wrote to memory of 5112 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 83 PID 628 wrote to memory of 964 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 84 PID 628 wrote to memory of 964 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 84 PID 628 wrote to memory of 964 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 84 PID 628 wrote to memory of 3496 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 85 PID 628 wrote to memory of 3496 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 85 PID 628 wrote to memory of 3496 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 85 PID 628 wrote to memory of 392 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 86 PID 628 wrote to memory of 392 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 86 PID 628 wrote to memory of 392 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 86 PID 628 wrote to memory of 4668 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 87 PID 628 wrote to memory of 4668 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 87 PID 628 wrote to memory of 4668 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 87 PID 628 wrote to memory of 3376 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 88 PID 628 wrote to memory of 3376 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 88 PID 628 wrote to memory of 3376 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 88 PID 5112 wrote to memory of 1356 5112 backup.exe 89 PID 5112 wrote to memory of 1356 5112 backup.exe 89 PID 5112 wrote to memory of 1356 5112 backup.exe 89 PID 628 wrote to memory of 3028 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 90 PID 628 wrote to memory of 3028 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 90 PID 628 wrote to memory of 3028 628 181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe 90 PID 1356 wrote to memory of 1460 1356 backup.exe 91 PID 1356 wrote to memory of 1460 1356 backup.exe 91 PID 1356 wrote to memory of 1460 1356 backup.exe 91 PID 1356 wrote to memory of 2356 1356 backup.exe 92 PID 1356 wrote to memory of 2356 1356 backup.exe 92 PID 1356 wrote to memory of 2356 1356 backup.exe 92 PID 1356 wrote to memory of 1140 1356 backup.exe 93 PID 1356 wrote to memory of 1140 1356 backup.exe 93 PID 1356 wrote to memory of 1140 1356 backup.exe 93 PID 1140 wrote to memory of 4152 1140 backup.exe 94 PID 1140 wrote to memory of 4152 1140 backup.exe 94 PID 1140 wrote to memory of 4152 1140 backup.exe 94 PID 4152 wrote to memory of 3540 4152 backup.exe 95 PID 4152 wrote to memory of 3540 4152 backup.exe 95 PID 4152 wrote to memory of 3540 4152 backup.exe 95 PID 1140 wrote to memory of 3808 1140 backup.exe 96 PID 1140 wrote to memory of 3808 1140 backup.exe 96 PID 1140 wrote to memory of 3808 1140 backup.exe 96 PID 3808 wrote to memory of 4496 3808 backup.exe 97 PID 3808 wrote to memory of 4496 3808 backup.exe 97 PID 3808 wrote to memory of 4496 3808 backup.exe 97 PID 1356 wrote to memory of 4100 1356 backup.exe 98 PID 1356 wrote to memory of 4100 1356 backup.exe 98 PID 1356 wrote to memory of 4100 1356 backup.exe 98 PID 3808 wrote to memory of 3156 3808 backup.exe 99 PID 3808 wrote to memory of 3156 3808 backup.exe 99 PID 3808 wrote to memory of 3156 3808 backup.exe 99 PID 1140 wrote to memory of 2888 1140 backup.exe 100 PID 1140 wrote to memory of 2888 1140 backup.exe 100 PID 1140 wrote to memory of 2888 1140 backup.exe 100 PID 4100 wrote to memory of 3112 4100 backup.exe 101 PID 4100 wrote to memory of 3112 4100 backup.exe 101 PID 4100 wrote to memory of 3112 4100 backup.exe 101 PID 2888 wrote to memory of 1432 2888 backup.exe 102 PID 2888 wrote to memory of 1432 2888 backup.exe 102 PID 2888 wrote to memory of 1432 2888 backup.exe 102 PID 3156 wrote to memory of 1044 3156 backup.exe 103 PID 3156 wrote to memory of 1044 3156 backup.exe 103 PID 3156 wrote to memory of 1044 3156 backup.exe 103 PID 3112 wrote to memory of 4476 3112 backup.exe 104 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe"C:\Users\Admin\AppData\Local\Temp\181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe"1⤵
- Disables RegEdit via registry modification
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3249027206\backup.exeC:\Users\Admin\AppData\Local\Temp\3249027206\backup.exe C:\Users\Admin\AppData\Local\Temp\3249027206\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1460
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2356
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1140 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3540
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4496
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1044
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4956 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2936
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1832
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2580
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4412
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4680
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4512
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5084
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- System policy modification
PID:788
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:844
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵PID:4488
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Drops file in Program Files directory
PID:4976 -
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1736
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4760
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:740
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2084
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3096
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
PID:4384
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵PID:2836
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\9⤵PID:2936
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\9⤵PID:3700
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\9⤵
- Disables RegEdit via registry modification
PID:4864
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵
- Disables RegEdit via registry modification
PID:2268
-
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2356
-
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2092
-
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵PID:3772
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3028 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵PID:3368
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵PID:4688
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵PID:2184
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵PID:1120
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4040
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵PID:2268
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- System policy modification
PID:208 -
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4928
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵PID:3260
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵PID:4996
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
PID:4680 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:1492
-
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3772
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵
- Disables RegEdit via registry modification
PID:4548 -
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:4796
-
-
-
C:\Program Files\Common Files\microsoft shared\VC\backup.exe"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\7⤵PID:1536
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
PID:240
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
PID:4924 -
C:\Program Files\Common Files\System\ado\data.exe"C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
PID:3128 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1684
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:2392
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
PID:1492
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1256
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:3776
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:4104
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:3664
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:4396
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1876
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1408
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2148
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
PID:736
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Drops file in Program Files directory
PID:1960 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2712
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1432 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4804 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1924 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4308
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5060
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4160
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4000
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3548
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2356 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:4828
-
-
C:\Program Files\Internet Explorer\en-US\update.exe"C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:2060
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- System policy modification
PID:1692
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:4412
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
- Disables RegEdit via registry modification
PID:3152
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
- System policy modification
PID:4180
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵PID:2276
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
- System policy modification
PID:8
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3180 -
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Drops file in Program Files directory
PID:756 -
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵PID:748
-
-
C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe"C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Disables RegEdit via registry modification
PID:2324 -
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\8⤵
- Modifies visibility of file extensions in Explorer
PID:2372
-
-
C:\Program Files\Java\jdk1.8.0_66\db\lib\update.exe"C:\Program Files\Java\jdk1.8.0_66\db\lib\update.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\8⤵PID:2520
-
-
-
C:\Program Files\Java\jdk1.8.0_66\include\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:4152 -
C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\8⤵
- System policy modification
PID:4448 -
C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\9⤵
- System policy modification
PID:1524
-
-
-
-
-
C:\Program Files\Java\jre1.8.0_66\backup.exe"C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\6⤵
- Disables RegEdit via registry modification
PID:2020 -
C:\Program Files\Java\jre1.8.0_66\bin\backup.exe"C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\7⤵PID:3196
-
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Drops file in Program Files directory
PID:1816 -
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵PID:3876
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵
- Disables RegEdit via registry modification
PID:1624
-
-
C:\Program Files\Microsoft Office\root\backup.exe"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\6⤵PID:1564
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4476 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3820
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3940 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2248 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2760
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4416 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2660
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4824
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4780 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5020
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:632 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4864
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵PID:4748
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵
- Disables RegEdit via registry modification
PID:2864
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\8⤵
- Modifies visibility of file extensions in Explorer
PID:444 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\9⤵PID:2836
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\8⤵
- Drops file in Program Files directory
- System policy modification
PID:1640 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:932 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\10⤵PID:3996
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\update.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1432 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
PID:3608 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:4504
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\9⤵
- Disables RegEdit via registry modification
PID:4688 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\10⤵
- Modifies visibility of file extensions in Explorer
PID:4488
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1120
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\8⤵
- System policy modification
PID:4168 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
PID:3456
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\8⤵
- System policy modification
PID:3676
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\8⤵
- Modifies visibility of file extensions in Explorer
PID:2568
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\8⤵PID:1176
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2004 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵PID:3524
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵PID:4320
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵PID:5100
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵PID:4008
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵PID:4448
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\8⤵PID:4088
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:3428
-
C:\Program Files (x86)\Common Files\Adobe\data.exe"C:\Program Files (x86)\Common Files\Adobe\data.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
- System policy modification
PID:3812 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
PID:4312
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- Drops file in Program Files directory
PID:1732
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- System policy modification
PID:4780 -
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵
- Disables RegEdit via registry modification
PID:3676
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵PID:3692
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵
- System policy modification
PID:2296 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\9⤵
- System policy modification
PID:3524 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\10⤵
- System policy modification
PID:2504
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\10⤵
- Modifies visibility of file extensions in Explorer
PID:3404 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\11⤵
- Modifies visibility of file extensions in Explorer
PID:1732
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\11⤵
- Disables RegEdit via registry modification
PID:4248 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\12⤵PID:4036
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\13⤵
- Disables RegEdit via registry modification
PID:640 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\14⤵PID:4396
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\14⤵PID:4412
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵PID:480
-
C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\7⤵PID:868
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4308
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:364 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Disables RegEdit via registry modification
PID:1528
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
- Modifies visibility of file extensions in Explorer
PID:4816
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:2024
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:4000
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3740 -
C:\Users\Admin\update.exeC:\Users\Admin\update.exe C:\Users\Admin\5⤵PID:1300
-
C:\Users\Admin\3D Objects\update.exe"C:\Users\Admin\3D Objects\update.exe" C:\Users\Admin\3D Objects\6⤵
- Disables RegEdit via registry modification
PID:2884
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:2504
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1620
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1552
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:2588
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:4364
-
-
C:\Users\Admin\Links\update.exeC:\Users\Admin\Links\update.exe C:\Users\Admin\Links\6⤵PID:4252
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Disables RegEdit via registry modification
PID:1468
-
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:5044
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Modifies visibility of file extensions in Explorer
PID:4600 -
C:\Users\Admin\Pictures\Camera Roll\backup.exe"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:3440
-
-
C:\Users\Admin\Pictures\Saved Pictures\backup.exe"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1736
-
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- System policy modification
PID:3132
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
- Disables RegEdit via registry modification
PID:5096
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3188
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:4408
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- System policy modification
PID:3420
-
-
C:\Users\Public\Downloads\update.exeC:\Users\Public\Downloads\update.exe C:\Users\Public\Downloads\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4132
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
- System policy modification
PID:1972
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
PID:5088 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:4496
-
-
C:\Windows\appcompat\data.exeC:\Windows\appcompat\data.exe C:\Windows\appcompat\5⤵
- Drops file in Windows directory
PID:2732 -
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Drops file in Windows directory
PID:880
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:392
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\1⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:2924 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\2⤵
- Drops file in Program Files directory
PID:3580 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\3⤵PID:3556
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\3⤵
- Disables RegEdit via registry modification
PID:212
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4260
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\2⤵
- Modifies visibility of file extensions in Explorer
PID:4244
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\1⤵
- Modifies visibility of file extensions in Explorer
PID:4092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD55910551d18e1e49d399b1bf8c7f1f87c
SHA10ca90fe7661d7a12603b8f02eecbf06b3982a378
SHA25612031118801ff2d5a58bf5e055e13bbd9db5c031cc676533e9d1217176134cea
SHA5124ed93f2af5eadb64e01c80686219392d0c1ac4773db8f06378adcb47dc7dcb65b4087eb9753ba88bc836149faba764275b2f81dc3a3ebd55f00486c645749e88
-
Filesize
72KB
MD55910551d18e1e49d399b1bf8c7f1f87c
SHA10ca90fe7661d7a12603b8f02eecbf06b3982a378
SHA25612031118801ff2d5a58bf5e055e13bbd9db5c031cc676533e9d1217176134cea
SHA5124ed93f2af5eadb64e01c80686219392d0c1ac4773db8f06378adcb47dc7dcb65b4087eb9753ba88bc836149faba764275b2f81dc3a3ebd55f00486c645749e88
-
Filesize
72KB
MD5eeb17930b0bf1d9f1bc909fed2a9d93c
SHA120b633ea945a566881656f73086168c12f42db4c
SHA2561b80e20388ac6b7cba8bd5501606ead6c3cb8c5726c860a57732da88be889d4e
SHA5129225cfad268bac9bb85bb7348b8a42d426e108925ffc2a3c832f4a048a3710fc710617766e187d6ed1ea7a3032e3fda20cb5d5f654b4ec76124ec6b65d0210d2
-
Filesize
72KB
MD5eeb17930b0bf1d9f1bc909fed2a9d93c
SHA120b633ea945a566881656f73086168c12f42db4c
SHA2561b80e20388ac6b7cba8bd5501606ead6c3cb8c5726c860a57732da88be889d4e
SHA5129225cfad268bac9bb85bb7348b8a42d426e108925ffc2a3c832f4a048a3710fc710617766e187d6ed1ea7a3032e3fda20cb5d5f654b4ec76124ec6b65d0210d2
-
Filesize
72KB
MD584c00e46f7e63f038a7a8a0f74648ccc
SHA104c8285e0a4aeeaf4d84ca34e90a820551cbb587
SHA256cfa23b5ef675eb176c60a107f36d69e7b6372b60ca5b6e60c864ee131c375f6c
SHA512d94fe9da08346d3927b64d2eff642db0810e59fc686dce971b8dfba86fd626a84fd8e3ef3cd217a058ad46ec2c4fe04c38a18d89c268f5ee0165190838c0424b
-
Filesize
72KB
MD584c00e46f7e63f038a7a8a0f74648ccc
SHA104c8285e0a4aeeaf4d84ca34e90a820551cbb587
SHA256cfa23b5ef675eb176c60a107f36d69e7b6372b60ca5b6e60c864ee131c375f6c
SHA512d94fe9da08346d3927b64d2eff642db0810e59fc686dce971b8dfba86fd626a84fd8e3ef3cd217a058ad46ec2c4fe04c38a18d89c268f5ee0165190838c0424b
-
Filesize
72KB
MD523214be108f447104f5b0995dfe1ee2c
SHA15d7456b2507ee6d35817d63dfeeb7af055d14b2d
SHA256945e32d8ba1e17c042db13fe5a267bb873972eac393bce1fceae8ef99ee355b6
SHA512d6e5e89e39f236d07aa80f1ebbd58cbaf527e34b277b8e6469a191a73eec8e036d7cc0b3b29a0a9196fd7e324f64a8c9c89fa924e8a20557e2ed28702a56f741
-
Filesize
72KB
MD523214be108f447104f5b0995dfe1ee2c
SHA15d7456b2507ee6d35817d63dfeeb7af055d14b2d
SHA256945e32d8ba1e17c042db13fe5a267bb873972eac393bce1fceae8ef99ee355b6
SHA512d6e5e89e39f236d07aa80f1ebbd58cbaf527e34b277b8e6469a191a73eec8e036d7cc0b3b29a0a9196fd7e324f64a8c9c89fa924e8a20557e2ed28702a56f741
-
Filesize
72KB
MD50de9b6b33bacccffdcc971ac2888704c
SHA12abcef28c353519ac7dd71a75f53d3af0959981c
SHA2560db19ece0f9859379a1b70a7512b943accbd5aa4f9abc95375080b320a0d5709
SHA512efb6748f939f1986646017809265d7a3a45a35b37259bd0279c024d5f9bced6068959125d2464c3e5839d7743cc34839637e665a54d119a7d88f7eb5fdc61743
-
Filesize
72KB
MD50de9b6b33bacccffdcc971ac2888704c
SHA12abcef28c353519ac7dd71a75f53d3af0959981c
SHA2560db19ece0f9859379a1b70a7512b943accbd5aa4f9abc95375080b320a0d5709
SHA512efb6748f939f1986646017809265d7a3a45a35b37259bd0279c024d5f9bced6068959125d2464c3e5839d7743cc34839637e665a54d119a7d88f7eb5fdc61743
-
Filesize
72KB
MD5ada9dc43f2f3b1b22ce82b67bdd52e36
SHA161236822a36d54f14f7ae125bb3b3ff79c263767
SHA2564965a9453fe47280bee92d835af47d8faf3976ecd2053037217683c0df0f1d3d
SHA5123d37c4a91971cb06349bce8b9bd5684f4f8e77fd0cb9edae3f3b5f806763a616159596f0696bdf60f8047c6dc49ff5844e027b4f1330e21976466f48993868e9
-
Filesize
72KB
MD5ada9dc43f2f3b1b22ce82b67bdd52e36
SHA161236822a36d54f14f7ae125bb3b3ff79c263767
SHA2564965a9453fe47280bee92d835af47d8faf3976ecd2053037217683c0df0f1d3d
SHA5123d37c4a91971cb06349bce8b9bd5684f4f8e77fd0cb9edae3f3b5f806763a616159596f0696bdf60f8047c6dc49ff5844e027b4f1330e21976466f48993868e9
-
Filesize
72KB
MD5da340e0a201dc2c8a9a78d7c18b76770
SHA1f9212f2441a7048b796f5837f36c8e3fc1e045a0
SHA256aeea3cc0c57e54eb55fa7d6353892e6805f9fbb96af4fc62b48546d1e79431c8
SHA512b610b327163d4edfde3f0f2f2e02bc299eddc0aaf71d728ec535309bc0898cb1558ab2f427c7657379e6ef61090e72f08c175a3ea47a6090b1a52b1e760b7d1b
-
Filesize
72KB
MD5da340e0a201dc2c8a9a78d7c18b76770
SHA1f9212f2441a7048b796f5837f36c8e3fc1e045a0
SHA256aeea3cc0c57e54eb55fa7d6353892e6805f9fbb96af4fc62b48546d1e79431c8
SHA512b610b327163d4edfde3f0f2f2e02bc299eddc0aaf71d728ec535309bc0898cb1558ab2f427c7657379e6ef61090e72f08c175a3ea47a6090b1a52b1e760b7d1b
-
Filesize
72KB
MD5ab59a9eab5aefcef9b2ec3e95f5605db
SHA10052ab8a8cb2c5a945c2433ba0c5bfd9d890daaa
SHA256bde4e7d5a5431331af314552429e5a04f2ecdbf2b0228029ac0804ca116680d5
SHA512d58b6f8d50f5110528b4d3e03277ec0b2ad8fb25e320e1c17b53fd0db27c8c8a5ab17cc928b76b56d9046d91759cfd1c27fcb3d5a1f6e54371c54903c1efd349
-
Filesize
72KB
MD5ab59a9eab5aefcef9b2ec3e95f5605db
SHA10052ab8a8cb2c5a945c2433ba0c5bfd9d890daaa
SHA256bde4e7d5a5431331af314552429e5a04f2ecdbf2b0228029ac0804ca116680d5
SHA512d58b6f8d50f5110528b4d3e03277ec0b2ad8fb25e320e1c17b53fd0db27c8c8a5ab17cc928b76b56d9046d91759cfd1c27fcb3d5a1f6e54371c54903c1efd349
-
Filesize
72KB
MD533273f0442308bc17001e782eedf117b
SHA11f22c47d000eef7e3240e75c10157bee14e5eefe
SHA2563731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b
SHA512e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56
-
Filesize
72KB
MD533273f0442308bc17001e782eedf117b
SHA11f22c47d000eef7e3240e75c10157bee14e5eefe
SHA2563731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b
SHA512e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56
-
Filesize
72KB
MD5a2b26e2d4b504469e9201204d99755ae
SHA1486fc611bf302c6acb02f14810e9ebca1e8c1e09
SHA256bb2e56200ed2c3f97ce8f68244e5b8a3f5581e47a3ccf7683533caa8a1425e5a
SHA5122623921297b4f641f83995eec5e02c480ed6a285d18e3e64a55efc7e93eb86688c06357598b08f5b5df6b47498c41cdbf5b812609c28c8e6bd6b7f99bb9873ae
-
Filesize
72KB
MD5a2b26e2d4b504469e9201204d99755ae
SHA1486fc611bf302c6acb02f14810e9ebca1e8c1e09
SHA256bb2e56200ed2c3f97ce8f68244e5b8a3f5581e47a3ccf7683533caa8a1425e5a
SHA5122623921297b4f641f83995eec5e02c480ed6a285d18e3e64a55efc7e93eb86688c06357598b08f5b5df6b47498c41cdbf5b812609c28c8e6bd6b7f99bb9873ae
-
Filesize
72KB
MD533273f0442308bc17001e782eedf117b
SHA11f22c47d000eef7e3240e75c10157bee14e5eefe
SHA2563731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b
SHA512e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56
-
Filesize
72KB
MD533273f0442308bc17001e782eedf117b
SHA11f22c47d000eef7e3240e75c10157bee14e5eefe
SHA2563731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b
SHA512e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56
-
Filesize
72KB
MD5958da80da7b88157688390f545f432bd
SHA1df06ba3b3ea2eef8c461db8e370289f2158297a7
SHA2560e7d70a3957da0539c6e8d64cb8a7220c55f301c16d5c191924f039c8d021ea1
SHA512c6cb432e7369542fc31e177d4850a2e2bf22cf16bd89278a5263956127a774b3e62ee2245bd7720e524885e960d7e2da0971ff8caf2523f477033c71f24423e8
-
Filesize
72KB
MD5958da80da7b88157688390f545f432bd
SHA1df06ba3b3ea2eef8c461db8e370289f2158297a7
SHA2560e7d70a3957da0539c6e8d64cb8a7220c55f301c16d5c191924f039c8d021ea1
SHA512c6cb432e7369542fc31e177d4850a2e2bf22cf16bd89278a5263956127a774b3e62ee2245bd7720e524885e960d7e2da0971ff8caf2523f477033c71f24423e8
-
Filesize
72KB
MD5aa03a70b22ac9949d744eaa73c4be450
SHA12877395e354e795cba649b7fe8927aabee9666f2
SHA25697ef926f1a58086affb7496555c6b31700e52011985b99c988b39810c4e4fbbe
SHA512ab4bff90835ecf2d0f39d56bfeb30db032876e384a1118a6b5e642d6294c71d38a165f20bfa216000bce2e93cd3276b4d4ed95d85edd6a5b05e780270490e342
-
Filesize
72KB
MD5aa03a70b22ac9949d744eaa73c4be450
SHA12877395e354e795cba649b7fe8927aabee9666f2
SHA25697ef926f1a58086affb7496555c6b31700e52011985b99c988b39810c4e4fbbe
SHA512ab4bff90835ecf2d0f39d56bfeb30db032876e384a1118a6b5e642d6294c71d38a165f20bfa216000bce2e93cd3276b4d4ed95d85edd6a5b05e780270490e342
-
Filesize
72KB
MD5a825cbc1dad8a37e8387092c45ee9790
SHA13d60efde38556fc0110bcc609fe8a3522e71725f
SHA256fe5176b63a6156f3a28efb416b87bd25632b564180829dd11c9ffd2bdf11531f
SHA512f4b85d3926da34347620a5614d20d1c4cd18be49796cd2924bad1e724ffbef2231fec651f4ce4ff0edeffc204f189a6ea70c6c71061e0a2fa93d632bc85ca54d
-
Filesize
72KB
MD5a825cbc1dad8a37e8387092c45ee9790
SHA13d60efde38556fc0110bcc609fe8a3522e71725f
SHA256fe5176b63a6156f3a28efb416b87bd25632b564180829dd11c9ffd2bdf11531f
SHA512f4b85d3926da34347620a5614d20d1c4cd18be49796cd2924bad1e724ffbef2231fec651f4ce4ff0edeffc204f189a6ea70c6c71061e0a2fa93d632bc85ca54d
-
Filesize
72KB
MD5dcc1fedd0714353caa83514a691cd430
SHA1caee41eb181f5c7253594a681758ed9b55c07a39
SHA256162eaa27965f9748b035da8f82e72cc534adcf7270c917b86a2178e839dadbdc
SHA512eb5922ea0947d87a7ccd27da298d4c1ffc4f0bc32171355c47abec8cc3eff426de676275ba447d13e6699852912420a69ded271e69724e8c966d34996f331132
-
Filesize
72KB
MD5dcc1fedd0714353caa83514a691cd430
SHA1caee41eb181f5c7253594a681758ed9b55c07a39
SHA256162eaa27965f9748b035da8f82e72cc534adcf7270c917b86a2178e839dadbdc
SHA512eb5922ea0947d87a7ccd27da298d4c1ffc4f0bc32171355c47abec8cc3eff426de676275ba447d13e6699852912420a69ded271e69724e8c966d34996f331132
-
Filesize
72KB
MD53e0bd14e663c68f65a40c419163d75a6
SHA112892e72e216cb780f2acd8a474f75890553bcd6
SHA2568c06a997105b8d008971a6151aed5f14e6ba7690cf8d646b7a160d0a3375c6b3
SHA5122a5d6b4b815232456597fb456cad69b02c11b0465bd7224659f60e27b2881798f8ed2ab800d61fb08befd5b21b7fb2ee50b647d86c0fe33e487fe22c859a3447
-
Filesize
72KB
MD53e0bd14e663c68f65a40c419163d75a6
SHA112892e72e216cb780f2acd8a474f75890553bcd6
SHA2568c06a997105b8d008971a6151aed5f14e6ba7690cf8d646b7a160d0a3375c6b3
SHA5122a5d6b4b815232456597fb456cad69b02c11b0465bd7224659f60e27b2881798f8ed2ab800d61fb08befd5b21b7fb2ee50b647d86c0fe33e487fe22c859a3447
-
Filesize
72KB
MD5c1f60943c32aa1f6384f46818155fbb6
SHA17ef4de2822b8297f72f9f2147e814bb3787d190c
SHA2569933badb1e12c106c147df944e05eb04f92a8ab285066082348e7b76d09769f1
SHA5127d93668982c77add0c0ead055b564e55aa31981030a1b5e7842a428844f0980968253f702461d6b8ef16358408cfd48d09289b2efe4a1c0e4cb8f0f4fb87eb57
-
Filesize
72KB
MD5c1f60943c32aa1f6384f46818155fbb6
SHA17ef4de2822b8297f72f9f2147e814bb3787d190c
SHA2569933badb1e12c106c147df944e05eb04f92a8ab285066082348e7b76d09769f1
SHA5127d93668982c77add0c0ead055b564e55aa31981030a1b5e7842a428844f0980968253f702461d6b8ef16358408cfd48d09289b2efe4a1c0e4cb8f0f4fb87eb57
-
Filesize
72KB
MD516758733801de9b95ada3327a2278b44
SHA10818b47731f31545ebbed8782ec8cfdade335928
SHA256550f475d3eb89653b8fca4843c2977d81f30f6d96daa4adda6452863c359194f
SHA512469f10cfaf0e2833a2735819937e9f9c85ca5e8b7772f4bf4732341a4684178d9b64076f9738b2da9e43263a1a43851fe0d4b1a539cf007cac07b12d0e00c375
-
Filesize
72KB
MD516758733801de9b95ada3327a2278b44
SHA10818b47731f31545ebbed8782ec8cfdade335928
SHA256550f475d3eb89653b8fca4843c2977d81f30f6d96daa4adda6452863c359194f
SHA512469f10cfaf0e2833a2735819937e9f9c85ca5e8b7772f4bf4732341a4684178d9b64076f9738b2da9e43263a1a43851fe0d4b1a539cf007cac07b12d0e00c375
-
Filesize
72KB
MD5807518d2b5b86249d49a64ee7386e86b
SHA19578286cafef6558f23e3235795397ab75f9a3ee
SHA256e7d121e8a86d17490a27d81e0a5a4ccb7612cd80154a2154f6b18300c6cb1676
SHA51225e57437f0e1f34ac0b7f8214f8ed9a0cfdddb79556e944de789af2a6119a2637c1bde650291f9f6897d5756bb73c356c7b29d8c54c87a2a22efbb7e022e7cd7
-
Filesize
72KB
MD5807518d2b5b86249d49a64ee7386e86b
SHA19578286cafef6558f23e3235795397ab75f9a3ee
SHA256e7d121e8a86d17490a27d81e0a5a4ccb7612cd80154a2154f6b18300c6cb1676
SHA51225e57437f0e1f34ac0b7f8214f8ed9a0cfdddb79556e944de789af2a6119a2637c1bde650291f9f6897d5756bb73c356c7b29d8c54c87a2a22efbb7e022e7cd7
-
Filesize
72KB
MD50dc7e02ceed86c13975d78e5fc2cb581
SHA14b392c9596c8c23262990befcb75ca3d9c112f78
SHA256a0c7f96047139664be3042c6db526ef6a870326716142efb9a0988ffee8885c2
SHA512c3e34f4493e5bcc5932129fa76a5e535123b9964a9b6fbad61d060cd479b6886d03a00babfd1cfc8652ba6f5c1d84515709ad444726e639379bd1bf7f6185318
-
Filesize
72KB
MD50dc7e02ceed86c13975d78e5fc2cb581
SHA14b392c9596c8c23262990befcb75ca3d9c112f78
SHA256a0c7f96047139664be3042c6db526ef6a870326716142efb9a0988ffee8885c2
SHA512c3e34f4493e5bcc5932129fa76a5e535123b9964a9b6fbad61d060cd479b6886d03a00babfd1cfc8652ba6f5c1d84515709ad444726e639379bd1bf7f6185318
-
Filesize
72KB
MD548706af2d21c02dda6999ae4bc45eb08
SHA1cd75c57f6cde85435ad72af811080ed189a63642
SHA25665c9241c12afec35f872ffb9240a321ec017ba3b154492e5922e6aeebe4dd929
SHA5122939a7045ff8891a808e46461fc8d6443d03ce42616aa24c1f59bbcb6a3fa8372acf0b6c4e737803b9dd7adaf20ef3551e887b6b949410a785254a02e9c3c837
-
Filesize
72KB
MD548706af2d21c02dda6999ae4bc45eb08
SHA1cd75c57f6cde85435ad72af811080ed189a63642
SHA25665c9241c12afec35f872ffb9240a321ec017ba3b154492e5922e6aeebe4dd929
SHA5122939a7045ff8891a808e46461fc8d6443d03ce42616aa24c1f59bbcb6a3fa8372acf0b6c4e737803b9dd7adaf20ef3551e887b6b949410a785254a02e9c3c837
-
Filesize
72KB
MD52a65992cebfb6e356f6ef4d8aaf91b38
SHA120c7c3c6bbd30a965a0b9f7bfc1c1f84dde5c6da
SHA256132a0ac98ced9d3dfde1a50bc842e18cff7927ed1f6b97f45b4c13928bf0c108
SHA5124b4f887e7a634db7c1ca58784494a9742c2e915bc653958db2e3fa78b91363ddd6e163945a90ef21c7df0742fa82d2b49d39d5cffcfef09c470f1795d1a72e04
-
Filesize
72KB
MD52a65992cebfb6e356f6ef4d8aaf91b38
SHA120c7c3c6bbd30a965a0b9f7bfc1c1f84dde5c6da
SHA256132a0ac98ced9d3dfde1a50bc842e18cff7927ed1f6b97f45b4c13928bf0c108
SHA5124b4f887e7a634db7c1ca58784494a9742c2e915bc653958db2e3fa78b91363ddd6e163945a90ef21c7df0742fa82d2b49d39d5cffcfef09c470f1795d1a72e04
-
Filesize
72KB
MD512f9a698da9232a38a0e8b5d3818a821
SHA1f7d3a75938b0606db4c64ee71e09599f142d6c88
SHA2569c2260bf744b8a2425039b5095579c3c631d571a51bca730113d5bbe461dfd3a
SHA5123114817b9887d4f7bbc23e1d449d07863fea314812fdc6eb77044b16a3fb3c97ebfa9e01daed2230736600db6ae2da78c6c73929b806a83dbba0317e750acf44
-
Filesize
72KB
MD512f9a698da9232a38a0e8b5d3818a821
SHA1f7d3a75938b0606db4c64ee71e09599f142d6c88
SHA2569c2260bf744b8a2425039b5095579c3c631d571a51bca730113d5bbe461dfd3a
SHA5123114817b9887d4f7bbc23e1d449d07863fea314812fdc6eb77044b16a3fb3c97ebfa9e01daed2230736600db6ae2da78c6c73929b806a83dbba0317e750acf44
-
Filesize
72KB
MD58187fbc2cdd0c5619d6b76cfa5e8ecb5
SHA1446fad6967345029b8db5b6f6020306badb6cf9a
SHA25689d11643b1a8d1e4d061519e90098470f991f81a276e9138b587a915d573e259
SHA512a61758b77f7d56b6f85aa21a6d28f38312c438b4d252d7bd1de2d531d515b5894a8512d48c784dae1ce9a360f30ecde443fd700213aedd11100d0430a90c235e
-
Filesize
72KB
MD58187fbc2cdd0c5619d6b76cfa5e8ecb5
SHA1446fad6967345029b8db5b6f6020306badb6cf9a
SHA25689d11643b1a8d1e4d061519e90098470f991f81a276e9138b587a915d573e259
SHA512a61758b77f7d56b6f85aa21a6d28f38312c438b4d252d7bd1de2d531d515b5894a8512d48c784dae1ce9a360f30ecde443fd700213aedd11100d0430a90c235e
-
Filesize
72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
Filesize
72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cac5fbcf248887aae503b7cf5624764f
SHA1bf4f198ec8dc0aee7afdfe014989a6c86fe1b614
SHA25657cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3
SHA5121954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cac5fbcf248887aae503b7cf5624764f
SHA1bf4f198ec8dc0aee7afdfe014989a6c86fe1b614
SHA25657cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3
SHA5121954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a
-
Filesize
72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
Filesize
72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
Filesize
72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
Filesize
72KB
MD5312bf9c5e3c9448f3b568281450ff450
SHA16f7b27cbf9d79737928ed155b746613c7f67a910
SHA256197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c
SHA512d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb
-
Filesize
72KB
MD5cac5fbcf248887aae503b7cf5624764f
SHA1bf4f198ec8dc0aee7afdfe014989a6c86fe1b614
SHA25657cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3
SHA5121954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a
-
Filesize
72KB
MD5cac5fbcf248887aae503b7cf5624764f
SHA1bf4f198ec8dc0aee7afdfe014989a6c86fe1b614
SHA25657cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3
SHA5121954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a
-
Filesize
72KB
MD52e61d2d4d1eb197de011947b5bed6bb1
SHA1044be2ea3caf028c30d7e1e4522dade15f9a6137
SHA256b914d3a75350baaea7e9d22f35fe61d90fb691b018ac17f381f29c30b77fd8b9
SHA51222da821ef6d37b038df294d84214fbf7935797bc2ccbd445881be44be3f2118457993af20b1915f094aeb13b5ec8dd0dd3a15306a6b859e5c17fa69c50887338
-
Filesize
72KB
MD52e61d2d4d1eb197de011947b5bed6bb1
SHA1044be2ea3caf028c30d7e1e4522dade15f9a6137
SHA256b914d3a75350baaea7e9d22f35fe61d90fb691b018ac17f381f29c30b77fd8b9
SHA51222da821ef6d37b038df294d84214fbf7935797bc2ccbd445881be44be3f2118457993af20b1915f094aeb13b5ec8dd0dd3a15306a6b859e5c17fa69c50887338
-
Filesize
72KB
MD501a42e24986fbde51985c46891efb2d8
SHA1cfe0a7119ba0c67f23ab3c3f5aec556095f7e72b
SHA2561be53b8f6f051267d9ce2bf1037fb104c29f3c3aed82392af093c998dd5f0d35
SHA51263756e57410f283d021506f48569b418bd6d6de95ef95ba2a6a52f3e7edcee0aeb738446dbfbb6745bf28e82ef2bd74137b34bb579dee423a03deea2e74db8df
-
Filesize
72KB
MD501a42e24986fbde51985c46891efb2d8
SHA1cfe0a7119ba0c67f23ab3c3f5aec556095f7e72b
SHA2561be53b8f6f051267d9ce2bf1037fb104c29f3c3aed82392af093c998dd5f0d35
SHA51263756e57410f283d021506f48569b418bd6d6de95ef95ba2a6a52f3e7edcee0aeb738446dbfbb6745bf28e82ef2bd74137b34bb579dee423a03deea2e74db8df