Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 05:09
Static task
static1
Behavioral task
behavioral1
Sample
79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe
Resource
win10v2004-20220812-en
General
-
Target
79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe
-
Size
72KB
-
MD5
a3029f304b6a1ee33bd3544a64c7c183
-
SHA1
f7109702be8134cb525e373dc8c3a2855c384819
-
SHA256
79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187
-
SHA512
5762b1b83da961da54ad02566a2b4a99593660e4c1bff8f4b187fce50924b543f27f657582beec8cbbeee51e4b964feb9334759b0544dbe0c2c7299740d68e98
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2q:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1704 System Restore.exe 824 backup.exe 588 backup.exe 844 backup.exe 1384 backup.exe 360 backup.exe 980 backup.exe 804 backup.exe 868 backup.exe 1584 backup.exe 1748 System Restore.exe 1276 backup.exe 1960 backup.exe 1672 backup.exe 692 backup.exe 972 backup.exe 1260 backup.exe 1528 backup.exe 948 backup.exe 1824 backup.exe 472 update.exe 1272 backup.exe 1176 backup.exe 2020 backup.exe 1832 backup.exe 1216 backup.exe 980 backup.exe 1556 backup.exe 1600 backup.exe 1940 backup.exe 240 backup.exe 1476 backup.exe 868 backup.exe 2032 backup.exe 1196 backup.exe 604 backup.exe 700 backup.exe 1080 backup.exe 1512 backup.exe 1140 backup.exe 1992 backup.exe 688 backup.exe 1732 backup.exe 972 backup.exe 1332 backup.exe 1684 update.exe 1680 backup.exe 916 backup.exe 1616 data.exe 864 backup.exe 1404 backup.exe 320 backup.exe 1176 backup.exe 2020 data.exe 1832 System Restore.exe 1032 backup.exe 980 backup.exe 1604 backup.exe 552 System Restore.exe 1752 backup.exe 1180 backup.exe 1956 backup.exe 868 System Restore.exe 1888 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 804 backup.exe 804 backup.exe 868 backup.exe 868 backup.exe 804 backup.exe 804 backup.exe 1748 System Restore.exe 1748 System Restore.exe 1276 backup.exe 1276 backup.exe 1748 System Restore.exe 1748 System Restore.exe 1672 backup.exe 1672 backup.exe 692 backup.exe 692 backup.exe 692 backup.exe 692 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 472 update.exe 472 update.exe 472 update.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1260 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 1704 System Restore.exe 824 backup.exe 588 backup.exe 844 backup.exe 1384 backup.exe 360 backup.exe 980 backup.exe 804 backup.exe 868 backup.exe 1584 backup.exe 1748 System Restore.exe 1276 backup.exe 1960 backup.exe 1672 backup.exe 692 backup.exe 972 backup.exe 1260 backup.exe 1528 backup.exe 948 backup.exe 1824 backup.exe 472 update.exe 1272 backup.exe 1176 backup.exe 2020 backup.exe 1832 backup.exe 1216 backup.exe 980 backup.exe 1556 backup.exe 1600 backup.exe 1940 backup.exe 240 backup.exe 1476 backup.exe 868 backup.exe 2032 backup.exe 1196 backup.exe 604 backup.exe 700 backup.exe 1080 backup.exe 1512 backup.exe 1140 backup.exe 1992 backup.exe 688 backup.exe 1732 backup.exe 972 backup.exe 1332 backup.exe 1684 update.exe 1680 backup.exe 916 backup.exe 1616 data.exe 864 backup.exe 1404 backup.exe 320 backup.exe 1176 backup.exe 2020 data.exe 1832 System Restore.exe 1032 backup.exe 980 backup.exe 1604 backup.exe 552 System Restore.exe 1752 backup.exe 1180 backup.exe 1956 backup.exe 868 System Restore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1352 wrote to memory of 1704 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 26 PID 1352 wrote to memory of 1704 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 26 PID 1352 wrote to memory of 1704 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 26 PID 1352 wrote to memory of 1704 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 26 PID 1352 wrote to memory of 824 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 27 PID 1352 wrote to memory of 824 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 27 PID 1352 wrote to memory of 824 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 27 PID 1352 wrote to memory of 824 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 27 PID 1352 wrote to memory of 588 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 28 PID 1352 wrote to memory of 588 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 28 PID 1352 wrote to memory of 588 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 28 PID 1352 wrote to memory of 588 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 28 PID 1352 wrote to memory of 844 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 29 PID 1352 wrote to memory of 844 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 29 PID 1352 wrote to memory of 844 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 29 PID 1352 wrote to memory of 844 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 29 PID 1352 wrote to memory of 1384 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 30 PID 1352 wrote to memory of 1384 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 30 PID 1352 wrote to memory of 1384 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 30 PID 1352 wrote to memory of 1384 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 30 PID 1352 wrote to memory of 360 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 31 PID 1352 wrote to memory of 360 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 31 PID 1352 wrote to memory of 360 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 31 PID 1352 wrote to memory of 360 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 31 PID 1352 wrote to memory of 980 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 32 PID 1352 wrote to memory of 980 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 32 PID 1352 wrote to memory of 980 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 32 PID 1352 wrote to memory of 980 1352 79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe 32 PID 1704 wrote to memory of 804 1704 System Restore.exe 33 PID 1704 wrote to memory of 804 1704 System Restore.exe 33 PID 1704 wrote to memory of 804 1704 System Restore.exe 33 PID 1704 wrote to memory of 804 1704 System Restore.exe 33 PID 804 wrote to memory of 868 804 backup.exe 34 PID 804 wrote to memory of 868 804 backup.exe 34 PID 804 wrote to memory of 868 804 backup.exe 34 PID 804 wrote to memory of 868 804 backup.exe 34 PID 868 wrote to memory of 1584 868 backup.exe 35 PID 868 wrote to memory of 1584 868 backup.exe 35 PID 868 wrote to memory of 1584 868 backup.exe 35 PID 868 wrote to memory of 1584 868 backup.exe 35 PID 804 wrote to memory of 1748 804 backup.exe 36 PID 804 wrote to memory of 1748 804 backup.exe 36 PID 804 wrote to memory of 1748 804 backup.exe 36 PID 804 wrote to memory of 1748 804 backup.exe 36 PID 1748 wrote to memory of 1276 1748 System Restore.exe 37 PID 1748 wrote to memory of 1276 1748 System Restore.exe 37 PID 1748 wrote to memory of 1276 1748 System Restore.exe 37 PID 1748 wrote to memory of 1276 1748 System Restore.exe 37 PID 1276 wrote to memory of 1960 1276 backup.exe 38 PID 1276 wrote to memory of 1960 1276 backup.exe 38 PID 1276 wrote to memory of 1960 1276 backup.exe 38 PID 1276 wrote to memory of 1960 1276 backup.exe 38 PID 1748 wrote to memory of 1672 1748 System Restore.exe 39 PID 1748 wrote to memory of 1672 1748 System Restore.exe 39 PID 1748 wrote to memory of 1672 1748 System Restore.exe 39 PID 1748 wrote to memory of 1672 1748 System Restore.exe 39 PID 1672 wrote to memory of 692 1672 backup.exe 40 PID 1672 wrote to memory of 692 1672 backup.exe 40 PID 1672 wrote to memory of 692 1672 backup.exe 40 PID 1672 wrote to memory of 692 1672 backup.exe 40 PID 692 wrote to memory of 972 692 backup.exe 41 PID 692 wrote to memory of 972 692 backup.exe 41 PID 692 wrote to memory of 972 692 backup.exe 41 PID 692 wrote to memory of 972 692 backup.exe 41 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe"C:\Users\Admin\AppData\Local\Temp\79ca06d0bca0e9ce55dfa7fb7ac775247e6daabd083931ebfeb05c870d2dc187.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2582008440\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\2582008440\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\2582008440\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:868 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1584
-
-
-
C:\Program Files\System Restore.exe"C:\Program Files\System Restore.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1960
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1272
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1216
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1476
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1080
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1512
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1140
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1732
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:864
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:1404
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵PID:868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:1276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1504
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵PID:276
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1884
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:868 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1276
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:992
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1208
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1348
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1636
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:276
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1000
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:1912
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:472
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1384
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1276
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:2080
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1752
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1804
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1600
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1696
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵PID:584
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:1176
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1964
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1836
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1000
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1280
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:688
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1724
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1680
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1260
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1556
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2040
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1736
-
-
C:\Program Files\Common Files\System\ja-JP\update.exe"C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:956
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:376
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:1996
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- Drops file in Program Files directory
PID:276
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵PID:1208
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:1740
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵PID:2056
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:2176
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1252
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵PID:604
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:544
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1496
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:580
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1384
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1664
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1700
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1040
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1736
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1924
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:2016
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1112
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1496
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1272
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:108
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:768
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:436
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:560
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:544
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:700
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:580
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:976
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵
- Modifies visibility of file extensions in Explorer
PID:544
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵PID:1540
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\8⤵PID:1004
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\8⤵PID:2116
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\8⤵PID:2232
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\8⤵PID:2316
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:952
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:900
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Drops file in Program Files directory
PID:1260 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1904
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1884
-
-
C:\Program Files\Java\data.exe"C:\Program Files\Java\data.exe" C:\Program Files\Java\5⤵PID:2012
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:836
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2016
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2124
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2268
-
-
C:\Program Files\Reference Assemblies\System Restore.exe"C:\Program Files\Reference Assemblies\System Restore.exe" C:\Program Files\Reference Assemblies\5⤵PID:2356
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1032 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980 -
C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1180
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:1888 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1960
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:1656
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1332
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1372
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:632
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:436
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1584
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:604
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1304
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1140
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:1988
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵PID:1624
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:808
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:524
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:240
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1476
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵PID:756
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:524
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:632
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1280
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1676
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1572
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:916
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:108
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2008
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1332
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1348
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1600
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1380
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1152
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:844
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:624
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1516
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1736
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1636
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1656
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2020
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1116
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2152
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2256
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1576
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:972
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2392
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1840
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1320
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:1060
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1508
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1912
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:2044
-
-
C:\Users\Admin\Favorites\System Restore.exe"C:\Users\Admin\Favorites\System Restore.exe" C:\Users\Admin\Favorites\6⤵PID:2064
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2192
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2284
-
-
C:\Users\Admin\Pictures\update.exeC:\Users\Admin\Pictures\update.exe C:\Users\Admin\Pictures\6⤵PID:2384
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:2040
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1832
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:360
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c791045be36250e96d902f442331541c
SHA1645321a82a0a80098ff3429676db7e5930d0e5ae
SHA2566e2649ad51c3c7d912553fc43ff48d03c67f91ace525814ef858284dc63c0d5c
SHA512090c50b73fb4ec568979579e091742369dbb0748bdcbc16a74025310be9bff297c23a13d7b037b874bad069c9e1b7ea16a9d4ea92c1623911fd41bc53461a082
-
Filesize
72KB
MD5f89f9d0a9d13a18bf49ba354c19d5231
SHA13e86a7afc54f70d60433e9f8b9177d7e4479f710
SHA256cfa8383cd7f3d3d2340290a14841d473fdeb11c01293ab7c667b6cacf637dcd3
SHA51234412a5fd361e3719e53952fccaba16f197715ed442c34ce4d66cb8af0978aac5cbff6a8745a543368d36e6a9d61d31a369056bd36d2bb7e0137d1d4d7faaf12
-
Filesize
72KB
MD5f89f9d0a9d13a18bf49ba354c19d5231
SHA13e86a7afc54f70d60433e9f8b9177d7e4479f710
SHA256cfa8383cd7f3d3d2340290a14841d473fdeb11c01293ab7c667b6cacf637dcd3
SHA51234412a5fd361e3719e53952fccaba16f197715ed442c34ce4d66cb8af0978aac5cbff6a8745a543368d36e6a9d61d31a369056bd36d2bb7e0137d1d4d7faaf12
-
Filesize
72KB
MD5c89897f2d027e832081d5f5b9735cf56
SHA164177677c2d224e1d1b3a7f3376c4beebb41d8cf
SHA2564b2706ac59ddceeabe748779bc225732531e9d77826e5654dd1a7adec17106c3
SHA5121b092e44750c8ba6a9be506ab31f72d6d66f672998d2727f14a715994e6e5c65607b92b1577dd93cf40dd930ca22c4b35890076bc0a56b1a7b59a592dcde833b
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD56d751368de3febcc01b2c335a95a88a8
SHA1e24749d97dc9b88a573618c60c72dbaf45ea0da5
SHA2566618d313a36ee736708731563c1f72129dc414d9f218ac2b8e90db3c0534cb8b
SHA5129a9577e5a0a79c0bd5ec98579e383fc05fa9b676ec4a84d6c9d84811ed422a15cdb4670ded2d15d4db1c0a2d5847dc86af6792a1e644d4411b1206426abf35cd
-
Filesize
72KB
MD56d751368de3febcc01b2c335a95a88a8
SHA1e24749d97dc9b88a573618c60c72dbaf45ea0da5
SHA2566618d313a36ee736708731563c1f72129dc414d9f218ac2b8e90db3c0534cb8b
SHA5129a9577e5a0a79c0bd5ec98579e383fc05fa9b676ec4a84d6c9d84811ed422a15cdb4670ded2d15d4db1c0a2d5847dc86af6792a1e644d4411b1206426abf35cd
-
Filesize
72KB
MD59f95da088ae9765b15fd515fd24cda70
SHA1cb39ddda8fb4c2f4aaaca2d0f4ff80f17ab368cb
SHA25682b8d1ee2c2933fff757b712d15bcae4686205e654757b4131d00a43b980a54b
SHA5122d24498fc9004a56237e2e51f8507a937a278cddd7898ae51293d6d9066198b7962d197a56d8627cfd419e75eb9bac0435d2adfc16998f4420fd6f7b906fcb1b
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD54dd7375386f1b4f16116e0e4ed5f189e
SHA10ed67597ab7a3fb1e6c458e0453b9cd11b672240
SHA2560a4dbd806589b4db67596501f269a35400aa4b6bc4c6b8c442beab04c21a4632
SHA5129b7bcb77340012029bf872c253cde9a69f52beb7dbf589f563a3b11c2065b5bd5a3e5df065ae5a94aba7fdb492b1a3e3d4899ffcc75238de1e0976da16956a5f
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD5ed12b2104c968145a0748cf0a48dcb5b
SHA1e52f9d087d09a82b4777a1cebe2cfe7920d16cba
SHA256e083db23c363bb9cdc44949b1cec08ee55841bc9b8841c1aeb51292666ab8acc
SHA512dc047e1b34f86403b5fdab8e5f2fd02a32834e8dd40050c4657cb37c80c0e7c3a50a3350780103263a4b04375523c6660c81d5e02728bb1ebcce078d3da746ed
-
Filesize
72KB
MD5ed12b2104c968145a0748cf0a48dcb5b
SHA1e52f9d087d09a82b4777a1cebe2cfe7920d16cba
SHA256e083db23c363bb9cdc44949b1cec08ee55841bc9b8841c1aeb51292666ab8acc
SHA512dc047e1b34f86403b5fdab8e5f2fd02a32834e8dd40050c4657cb37c80c0e7c3a50a3350780103263a4b04375523c6660c81d5e02728bb1ebcce078d3da746ed
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5c846d6d911c2a9d29eba129fbc8a2c02
SHA15b4368eccf41f0e3f67f6457c1f7c0f49548c741
SHA256dbd4540b93959026e7cfc9223896816993a0fa203ae80bed9fa422dc03892fac
SHA51242e455554a974f9174e957deb1ea5c4c8fa98572b6315524a4a6e33cf8f5fe4e6abc86a432970bdcdcc22a5621831544d5882b92e1be3152443ca42e438156aa
-
Filesize
72KB
MD5c846d6d911c2a9d29eba129fbc8a2c02
SHA15b4368eccf41f0e3f67f6457c1f7c0f49548c741
SHA256dbd4540b93959026e7cfc9223896816993a0fa203ae80bed9fa422dc03892fac
SHA51242e455554a974f9174e957deb1ea5c4c8fa98572b6315524a4a6e33cf8f5fe4e6abc86a432970bdcdcc22a5621831544d5882b92e1be3152443ca42e438156aa
-
Filesize
72KB
MD5c791045be36250e96d902f442331541c
SHA1645321a82a0a80098ff3429676db7e5930d0e5ae
SHA2566e2649ad51c3c7d912553fc43ff48d03c67f91ace525814ef858284dc63c0d5c
SHA512090c50b73fb4ec568979579e091742369dbb0748bdcbc16a74025310be9bff297c23a13d7b037b874bad069c9e1b7ea16a9d4ea92c1623911fd41bc53461a082
-
Filesize
72KB
MD5c791045be36250e96d902f442331541c
SHA1645321a82a0a80098ff3429676db7e5930d0e5ae
SHA2566e2649ad51c3c7d912553fc43ff48d03c67f91ace525814ef858284dc63c0d5c
SHA512090c50b73fb4ec568979579e091742369dbb0748bdcbc16a74025310be9bff297c23a13d7b037b874bad069c9e1b7ea16a9d4ea92c1623911fd41bc53461a082
-
Filesize
72KB
MD5f89f9d0a9d13a18bf49ba354c19d5231
SHA13e86a7afc54f70d60433e9f8b9177d7e4479f710
SHA256cfa8383cd7f3d3d2340290a14841d473fdeb11c01293ab7c667b6cacf637dcd3
SHA51234412a5fd361e3719e53952fccaba16f197715ed442c34ce4d66cb8af0978aac5cbff6a8745a543368d36e6a9d61d31a369056bd36d2bb7e0137d1d4d7faaf12
-
Filesize
72KB
MD5f89f9d0a9d13a18bf49ba354c19d5231
SHA13e86a7afc54f70d60433e9f8b9177d7e4479f710
SHA256cfa8383cd7f3d3d2340290a14841d473fdeb11c01293ab7c667b6cacf637dcd3
SHA51234412a5fd361e3719e53952fccaba16f197715ed442c34ce4d66cb8af0978aac5cbff6a8745a543368d36e6a9d61d31a369056bd36d2bb7e0137d1d4d7faaf12
-
Filesize
72KB
MD5c89897f2d027e832081d5f5b9735cf56
SHA164177677c2d224e1d1b3a7f3376c4beebb41d8cf
SHA2564b2706ac59ddceeabe748779bc225732531e9d77826e5654dd1a7adec17106c3
SHA5121b092e44750c8ba6a9be506ab31f72d6d66f672998d2727f14a715994e6e5c65607b92b1577dd93cf40dd930ca22c4b35890076bc0a56b1a7b59a592dcde833b
-
Filesize
72KB
MD5c89897f2d027e832081d5f5b9735cf56
SHA164177677c2d224e1d1b3a7f3376c4beebb41d8cf
SHA2564b2706ac59ddceeabe748779bc225732531e9d77826e5654dd1a7adec17106c3
SHA5121b092e44750c8ba6a9be506ab31f72d6d66f672998d2727f14a715994e6e5c65607b92b1577dd93cf40dd930ca22c4b35890076bc0a56b1a7b59a592dcde833b
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD56d751368de3febcc01b2c335a95a88a8
SHA1e24749d97dc9b88a573618c60c72dbaf45ea0da5
SHA2566618d313a36ee736708731563c1f72129dc414d9f218ac2b8e90db3c0534cb8b
SHA5129a9577e5a0a79c0bd5ec98579e383fc05fa9b676ec4a84d6c9d84811ed422a15cdb4670ded2d15d4db1c0a2d5847dc86af6792a1e644d4411b1206426abf35cd
-
Filesize
72KB
MD56d751368de3febcc01b2c335a95a88a8
SHA1e24749d97dc9b88a573618c60c72dbaf45ea0da5
SHA2566618d313a36ee736708731563c1f72129dc414d9f218ac2b8e90db3c0534cb8b
SHA5129a9577e5a0a79c0bd5ec98579e383fc05fa9b676ec4a84d6c9d84811ed422a15cdb4670ded2d15d4db1c0a2d5847dc86af6792a1e644d4411b1206426abf35cd
-
Filesize
72KB
MD59f95da088ae9765b15fd515fd24cda70
SHA1cb39ddda8fb4c2f4aaaca2d0f4ff80f17ab368cb
SHA25682b8d1ee2c2933fff757b712d15bcae4686205e654757b4131d00a43b980a54b
SHA5122d24498fc9004a56237e2e51f8507a937a278cddd7898ae51293d6d9066198b7962d197a56d8627cfd419e75eb9bac0435d2adfc16998f4420fd6f7b906fcb1b
-
Filesize
72KB
MD59f95da088ae9765b15fd515fd24cda70
SHA1cb39ddda8fb4c2f4aaaca2d0f4ff80f17ab368cb
SHA25682b8d1ee2c2933fff757b712d15bcae4686205e654757b4131d00a43b980a54b
SHA5122d24498fc9004a56237e2e51f8507a937a278cddd7898ae51293d6d9066198b7962d197a56d8627cfd419e75eb9bac0435d2adfc16998f4420fd6f7b906fcb1b
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD51dc349286776502358ffdf7367bf6697
SHA11847e953bb45c8834eacc0c51182e2bd3f5426b6
SHA256b9e6ca22c9e4d8eb01206dc1626b102c63409b5c3696fe1bc2c0dbf4bd5d9433
SHA51217ccae605770fdde584083eddf6b4540317926ca2e04ba3371f3a1a5200b2c68d87092e9425104aaa0bcc3702903df857a1176371bcd690b81ca583aa2a72027
-
Filesize
72KB
MD54dd7375386f1b4f16116e0e4ed5f189e
SHA10ed67597ab7a3fb1e6c458e0453b9cd11b672240
SHA2560a4dbd806589b4db67596501f269a35400aa4b6bc4c6b8c442beab04c21a4632
SHA5129b7bcb77340012029bf872c253cde9a69f52beb7dbf589f563a3b11c2065b5bd5a3e5df065ae5a94aba7fdb492b1a3e3d4899ffcc75238de1e0976da16956a5f
-
Filesize
72KB
MD54dd7375386f1b4f16116e0e4ed5f189e
SHA10ed67597ab7a3fb1e6c458e0453b9cd11b672240
SHA2560a4dbd806589b4db67596501f269a35400aa4b6bc4c6b8c442beab04c21a4632
SHA5129b7bcb77340012029bf872c253cde9a69f52beb7dbf589f563a3b11c2065b5bd5a3e5df065ae5a94aba7fdb492b1a3e3d4899ffcc75238de1e0976da16956a5f
-
Filesize
72KB
MD54dd7375386f1b4f16116e0e4ed5f189e
SHA10ed67597ab7a3fb1e6c458e0453b9cd11b672240
SHA2560a4dbd806589b4db67596501f269a35400aa4b6bc4c6b8c442beab04c21a4632
SHA5129b7bcb77340012029bf872c253cde9a69f52beb7dbf589f563a3b11c2065b5bd5a3e5df065ae5a94aba7fdb492b1a3e3d4899ffcc75238de1e0976da16956a5f
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD5c2e894bcf7f52722579f76041e9043ed
SHA15e5c8cae1aeace06d2ba4a3b76a2e42b4653517e
SHA2562d6b67ce0b363961431952f616ebc4f8ffe4d0f2c354188f66117037a3780829
SHA512c7b743aad1062a6d59f2244c14a72f307f711f5b734d44a537cbdb1353b205d47e4bd16fc7aadbeb39c3f5c4f584d52debd2cefcfa8a2f4aad1492102aea49e4
-
Filesize
72KB
MD5ed12b2104c968145a0748cf0a48dcb5b
SHA1e52f9d087d09a82b4777a1cebe2cfe7920d16cba
SHA256e083db23c363bb9cdc44949b1cec08ee55841bc9b8841c1aeb51292666ab8acc
SHA512dc047e1b34f86403b5fdab8e5f2fd02a32834e8dd40050c4657cb37c80c0e7c3a50a3350780103263a4b04375523c6660c81d5e02728bb1ebcce078d3da746ed
-
Filesize
72KB
MD5ed12b2104c968145a0748cf0a48dcb5b
SHA1e52f9d087d09a82b4777a1cebe2cfe7920d16cba
SHA256e083db23c363bb9cdc44949b1cec08ee55841bc9b8841c1aeb51292666ab8acc
SHA512dc047e1b34f86403b5fdab8e5f2fd02a32834e8dd40050c4657cb37c80c0e7c3a50a3350780103263a4b04375523c6660c81d5e02728bb1ebcce078d3da746ed
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c
-
Filesize
72KB
MD5193967618e8f2efad25bff6df4928aea
SHA1c302fb8217337bcaaa14458c07a1960cf2a6f0e0
SHA25641c07942618d1795559698b75273a432bde21ce50454d42167af5d5f48271181
SHA512227d123109a29f62fc5fa4c909971f9c27d4ae1b4ba6933861bfbf775ec344da0361484a1a52307ee130b8ebdbf45c703820de1398293f0793ebc4dec63b702c