Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe
Resource
win10v2004-20220812-en
General
-
Target
962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe
-
Size
72KB
-
MD5
05ae102aa580eeb458e27a6154370367
-
SHA1
1a8f6b30291ac3ac0ddca91d7b43e43f7d603093
-
SHA256
962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65
-
SHA512
44e191a1a4e2cfcbf7c9a71161569bd78d4139301cb582cdfff2c8485d45e873f6a92ac7d0b642e3b342e5395a4c2fa21e683c2ac075633596b9dd6332e19326
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2j:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr8+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1372 backup.exe 996 backup.exe 368 backup.exe 1740 backup.exe 1708 backup.exe 1064 backup.exe 1652 backup.exe 904 backup.exe 1604 backup.exe 596 backup.exe 856 System Restore.exe 2008 backup.exe 1788 backup.exe 1332 backup.exe 1800 backup.exe 1824 data.exe 1816 backup.exe 1984 backup.exe 820 backup.exe 1296 data.exe 944 backup.exe 1220 backup.exe 1716 backup.exe 1176 backup.exe 1708 backup.exe 560 backup.exe 1468 backup.exe 1472 backup.exe 1552 backup.exe 764 backup.exe 976 backup.exe 1652 backup.exe 1900 backup.exe 2028 backup.exe 2000 backup.exe 1480 backup.exe 1688 backup.exe 1944 backup.exe 360 backup.exe 1300 backup.exe 1028 backup.exe 1544 backup.exe 1892 backup.exe 1968 backup.exe 1448 backup.exe 1616 backup.exe 948 backup.exe 1952 backup.exe 1948 backup.exe 944 backup.exe 1356 backup.exe 524 backup.exe 680 backup.exe 1328 System Restore.exe 1708 backup.exe 1324 backup.exe 560 backup.exe 2044 backup.exe 1604 backup.exe 1580 backup.exe 840 backup.exe 1876 backup.exe 1056 backup.exe 1652 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1740 backup.exe 1740 backup.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1652 backup.exe 1652 backup.exe 1740 backup.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1740 backup.exe 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 596 backup.exe 596 backup.exe 2008 backup.exe 2008 backup.exe 596 backup.exe 596 backup.exe 1332 backup.exe 1332 backup.exe 1800 backup.exe 1800 backup.exe 1800 backup.exe 1800 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Reference Assemblies\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 1372 backup.exe 996 backup.exe 368 backup.exe 1708 backup.exe 1740 backup.exe 1064 backup.exe 1652 backup.exe 904 backup.exe 1604 backup.exe 856 System Restore.exe 596 backup.exe 2008 backup.exe 1788 backup.exe 1332 backup.exe 1800 backup.exe 1824 data.exe 1816 backup.exe 1984 backup.exe 820 backup.exe 1296 data.exe 944 backup.exe 1220 backup.exe 1716 backup.exe 1176 backup.exe 1708 backup.exe 560 backup.exe 1468 backup.exe 1472 backup.exe 1552 backup.exe 764 backup.exe 976 backup.exe 1652 backup.exe 1900 backup.exe 2028 backup.exe 2000 backup.exe 1480 backup.exe 1688 backup.exe 1944 backup.exe 360 backup.exe 1300 backup.exe 1544 backup.exe 1028 backup.exe 1892 backup.exe 1448 backup.exe 1968 backup.exe 1616 backup.exe 948 backup.exe 1952 backup.exe 1948 backup.exe 944 backup.exe 1356 backup.exe 680 backup.exe 524 backup.exe 1328 System Restore.exe 1708 backup.exe 1324 backup.exe 560 backup.exe 2044 backup.exe 1604 backup.exe 1580 backup.exe 840 backup.exe 1652 backup.exe 1876 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1372 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 26 PID 1260 wrote to memory of 1372 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 26 PID 1260 wrote to memory of 1372 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 26 PID 1260 wrote to memory of 1372 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 26 PID 1260 wrote to memory of 996 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 27 PID 1260 wrote to memory of 996 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 27 PID 1260 wrote to memory of 996 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 27 PID 1260 wrote to memory of 996 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 27 PID 1260 wrote to memory of 368 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 28 PID 1260 wrote to memory of 368 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 28 PID 1260 wrote to memory of 368 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 28 PID 1260 wrote to memory of 368 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 28 PID 1260 wrote to memory of 1708 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 30 PID 1260 wrote to memory of 1708 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 30 PID 1260 wrote to memory of 1708 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 30 PID 1260 wrote to memory of 1708 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 30 PID 1372 wrote to memory of 1740 1372 backup.exe 29 PID 1372 wrote to memory of 1740 1372 backup.exe 29 PID 1372 wrote to memory of 1740 1372 backup.exe 29 PID 1372 wrote to memory of 1740 1372 backup.exe 29 PID 1260 wrote to memory of 1064 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 31 PID 1260 wrote to memory of 1064 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 31 PID 1260 wrote to memory of 1064 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 31 PID 1260 wrote to memory of 1064 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 31 PID 1740 wrote to memory of 1652 1740 backup.exe 32 PID 1740 wrote to memory of 1652 1740 backup.exe 32 PID 1740 wrote to memory of 1652 1740 backup.exe 32 PID 1740 wrote to memory of 1652 1740 backup.exe 32 PID 1260 wrote to memory of 904 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 33 PID 1260 wrote to memory of 904 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 33 PID 1260 wrote to memory of 904 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 33 PID 1260 wrote to memory of 904 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 33 PID 1652 wrote to memory of 1604 1652 backup.exe 34 PID 1652 wrote to memory of 1604 1652 backup.exe 34 PID 1652 wrote to memory of 1604 1652 backup.exe 34 PID 1652 wrote to memory of 1604 1652 backup.exe 34 PID 1740 wrote to memory of 596 1740 backup.exe 36 PID 1740 wrote to memory of 596 1740 backup.exe 36 PID 1740 wrote to memory of 596 1740 backup.exe 36 PID 1740 wrote to memory of 596 1740 backup.exe 36 PID 1260 wrote to memory of 856 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 35 PID 1260 wrote to memory of 856 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 35 PID 1260 wrote to memory of 856 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 35 PID 1260 wrote to memory of 856 1260 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe 35 PID 596 wrote to memory of 2008 596 backup.exe 37 PID 596 wrote to memory of 2008 596 backup.exe 37 PID 596 wrote to memory of 2008 596 backup.exe 37 PID 596 wrote to memory of 2008 596 backup.exe 37 PID 2008 wrote to memory of 1788 2008 backup.exe 38 PID 2008 wrote to memory of 1788 2008 backup.exe 38 PID 2008 wrote to memory of 1788 2008 backup.exe 38 PID 2008 wrote to memory of 1788 2008 backup.exe 38 PID 596 wrote to memory of 1332 596 backup.exe 39 PID 596 wrote to memory of 1332 596 backup.exe 39 PID 596 wrote to memory of 1332 596 backup.exe 39 PID 596 wrote to memory of 1332 596 backup.exe 39 PID 1332 wrote to memory of 1800 1332 backup.exe 40 PID 1332 wrote to memory of 1800 1332 backup.exe 40 PID 1332 wrote to memory of 1800 1332 backup.exe 40 PID 1332 wrote to memory of 1800 1332 backup.exe 40 PID 1800 wrote to memory of 1824 1800 backup.exe 41 PID 1800 wrote to memory of 1824 1800 backup.exe 41 PID 1800 wrote to memory of 1824 1800 backup.exe 41 PID 1800 wrote to memory of 1824 1800 backup.exe 41 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe"C:\Users\Admin\AppData\Local\Temp\962edebc6dcc11d23d1e663f40ff499c88b32c2868c94a7e541bd37673629f65.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\446632319\backup.exeC:\Users\Admin\AppData\Local\Temp\446632319\backup.exe C:\Users\Admin\AppData\Local\Temp\446632319\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1372 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2008 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1788
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1800 -
C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\data.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1816 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:820
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1296
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:1876
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1296
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1340
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:2144
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1812
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:276
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:584
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\data.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\data.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1968
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1328
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:544
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1824
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1544 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1708 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:1056 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1924
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1300
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
PID:1732
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1568
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1808
-
-
-
C:\Program Files\Common Files\System\de-DE\update.exe"C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:624
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1408
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1028
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:976
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1972
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1060
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2120
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2284
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1300
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:944
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:840
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1992
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
PID:1620 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1896 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1120
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:2004
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1872
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1956
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1476
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1004
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:2112
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:2276
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- System policy modification
PID:1544 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:736
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1412
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1992
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1332
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1584
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2028
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2056
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2228
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:360 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:560
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:1520
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1880
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1216
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1700
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:840
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
PID:892
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1620
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1812
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:764
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2104
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1656 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:856
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1892
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1168
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:952
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1948
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2032 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:924
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1952 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:584
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\update.exe"C:\Program Files (x86)\Common Files\Adobe\Help\update.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1544
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:2172
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1820
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1976
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1924
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:960
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\update.exe"C:\Program Files (x86)\Common Files\SpeechEngines\update.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
PID:1872
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2252
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:560 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1388
-
-
C:\Program Files (x86)\Google\Policies\System Restore.exe"C:\Program Files (x86)\Google\Policies\System Restore.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1760
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1680
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1756
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1712 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:660
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:2184
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1636 -
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵PID:1944
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2244
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1948 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1316 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:2200
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
PID:1592 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1368
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1940
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:2088
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:2268
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:360
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1704
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1744
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1724
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2236
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:368
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD55f776fde5b7d7d63392f060d9fa00f13
SHA1725ce53d37b97110eacc2a8ac7c71d5c742f6f5c
SHA2564b5542a74f84d5c1bb5bd94741d7ea92a1d02887bcecdf8d54dce2ed5e77006b
SHA51285b0cc4cc9c67b329b025bd35f80188550cfb38113c92479e6ec60dc54f9343796ed0a323b39c3ea35c74d9056fcc73cca247b516d3a54fe904e9574bd1fd3f9
-
Filesize
72KB
MD5fcdbd5297289a915bd52e3b17875f7b7
SHA1300b999f55d85b1417dc27136be2909c1423bfdf
SHA2563b589af37480f9bf714e74df52d2bebd4ea81f872aa66b5db7e9318948270026
SHA5126803d1455545a9a76e665398e2fdf7b49b4ea73044e330892809b154aeeb9ab971f79c2486fd0be84feadd021759d7d2f640802e734571bfe23659844e55e3e2
-
Filesize
72KB
MD5fcdbd5297289a915bd52e3b17875f7b7
SHA1300b999f55d85b1417dc27136be2909c1423bfdf
SHA2563b589af37480f9bf714e74df52d2bebd4ea81f872aa66b5db7e9318948270026
SHA5126803d1455545a9a76e665398e2fdf7b49b4ea73044e330892809b154aeeb9ab971f79c2486fd0be84feadd021759d7d2f640802e734571bfe23659844e55e3e2
-
Filesize
72KB
MD5ba588a9bb4527230b4a2067b27d82438
SHA10ed4e0762f6beec13f3f34bad2661179bc726f5b
SHA2564c746c22e04496045b681503ba5269efb21b2083b49a794b8a3fe58d3de8f03f
SHA5120bd1a8f467cebda1c060febf92b10676cea5168967b9f8d7b1665320448484dd989db8a3eaeb341d8ce1bfcf7ebc2bf4dbe9fa201cba655b7a3547501a781e9d
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD5c711ec7a3d49e53e5ffa0488ce249936
SHA107aa3d6f51c180ceccc0df259d06f2ba9ee49bdc
SHA25684a67950ccefc633a6177a5e0cceee2a16e37654c8d681c258b12cbe9e7fba6c
SHA512d4d1b9756a944531da29edf28035a4ea9ed57d98c3c9756d62fcc5c670cd57f02b6750a9ef8a4acc5333164cdba8d3825e7d45025b9d157b192c5861ed1335c4
-
Filesize
72KB
MD5c711ec7a3d49e53e5ffa0488ce249936
SHA107aa3d6f51c180ceccc0df259d06f2ba9ee49bdc
SHA25684a67950ccefc633a6177a5e0cceee2a16e37654c8d681c258b12cbe9e7fba6c
SHA512d4d1b9756a944531da29edf28035a4ea9ed57d98c3c9756d62fcc5c670cd57f02b6750a9ef8a4acc5333164cdba8d3825e7d45025b9d157b192c5861ed1335c4
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5daedf02adbaf9e94c331df97585ba555
SHA11864b450379e3f7f814a5c4624f9f430931cd4d2
SHA256bfdda64b4fbb129b9cfb675808ba6ff3710d680fddb40bfb8a2a28037eac4b27
SHA512e39e855ff26387fd80b69126b3d6ebac62a1e4cebcdfc4f651b467d1382e5855f2c4c6fbd46992921039c069a831b0b38b32fc7cf8b7f6efecb0d53553808ec3
-
Filesize
72KB
MD5daedf02adbaf9e94c331df97585ba555
SHA11864b450379e3f7f814a5c4624f9f430931cd4d2
SHA256bfdda64b4fbb129b9cfb675808ba6ff3710d680fddb40bfb8a2a28037eac4b27
SHA512e39e855ff26387fd80b69126b3d6ebac62a1e4cebcdfc4f651b467d1382e5855f2c4c6fbd46992921039c069a831b0b38b32fc7cf8b7f6efecb0d53553808ec3
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD593db2080bf119d7f16c610ee67b5ad0b
SHA1f44451e599330f1b3327c1f10e707e776e513f37
SHA2566b38fbcee88098d79f37f58e0d9fc2f2aca5422aaf7d98a965a343290dbb0682
SHA51279928b0dc61e6863e29c1baf4fb04e3ec44093c0197b4d0fae703ce23ca16cf9dd0d5c14963598ad16a9bd61c6314c1e0886b813f0f5e637957a156861dfc4e4
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD593db2080bf119d7f16c610ee67b5ad0b
SHA1f44451e599330f1b3327c1f10e707e776e513f37
SHA2566b38fbcee88098d79f37f58e0d9fc2f2aca5422aaf7d98a965a343290dbb0682
SHA51279928b0dc61e6863e29c1baf4fb04e3ec44093c0197b4d0fae703ce23ca16cf9dd0d5c14963598ad16a9bd61c6314c1e0886b813f0f5e637957a156861dfc4e4
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5df6a9b3c84919d301f06050ee0e821a6
SHA1c2f942181df41da9df47654bab77ddaa29de1194
SHA256c8b0f066e9e46d636d22bafd31086e01e4fb794e72687f87e332a4ed8ebbbf11
SHA5120c643b1cbd194c62418a6d1fc313d19554ab917dcdf6397abb384a908b61896b85aa510f654713b460fe2858185d30b2366ed3c98a88d6847dace7b7ef18b55b
-
Filesize
72KB
MD5d6427d42f4719d0d01a526a4890ce3e7
SHA17a716e92eb3249cdba2647e485a5150c6ae86f7c
SHA256422a3dfbb4b96a9c23a817d1e45b266af6bd735af6b6ec92ec4d2a55f9953018
SHA5121a1bdaaa5ff8a9adbbb44d25b559ce4b0326486cfafc6e909702fadf567abb7a0d4c4d99e9a40820c1083fa1d3de87034b9e7b5ee1b698ead5464e4a01b34af5
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD5f2dacd99234c9265f211651a22de0aee
SHA1ce7a2a79c1c8ed1b9d317f4df3a7c2ebfed53518
SHA2563b43dd47b6db769cacc3799d00f0252c4bf9b9f13146c83ccc0c006e24e7707f
SHA512cb9e7e4d190c63b10547c29ecf5546eea15a5f8fad518eb6999804247c846589be01a2f8f5ca7453fc3f513c02e3656c081e5c9ffa780b06591253e21f2bdd20
-
Filesize
72KB
MD503d49ebdda185089c70ca9c1241437ad
SHA189c1e2a347183be7c2a00455b988b755dd262f2d
SHA256e5074c87f4fc1cceca84f0a3cddc7760a29598cf6b7a6ff67fa2f1f0e570cf5d
SHA512dc899f535941effc2f77df9776f44bb93287b33662da10334956d30792c5de80a8345e1ad717e9bda1c948879b6829dcfe9494e51cdf60080e1fbe67d80d1057
-
Filesize
72KB
MD503d49ebdda185089c70ca9c1241437ad
SHA189c1e2a347183be7c2a00455b988b755dd262f2d
SHA256e5074c87f4fc1cceca84f0a3cddc7760a29598cf6b7a6ff67fa2f1f0e570cf5d
SHA512dc899f535941effc2f77df9776f44bb93287b33662da10334956d30792c5de80a8345e1ad717e9bda1c948879b6829dcfe9494e51cdf60080e1fbe67d80d1057
-
Filesize
72KB
MD55f776fde5b7d7d63392f060d9fa00f13
SHA1725ce53d37b97110eacc2a8ac7c71d5c742f6f5c
SHA2564b5542a74f84d5c1bb5bd94741d7ea92a1d02887bcecdf8d54dce2ed5e77006b
SHA51285b0cc4cc9c67b329b025bd35f80188550cfb38113c92479e6ec60dc54f9343796ed0a323b39c3ea35c74d9056fcc73cca247b516d3a54fe904e9574bd1fd3f9
-
Filesize
72KB
MD55f776fde5b7d7d63392f060d9fa00f13
SHA1725ce53d37b97110eacc2a8ac7c71d5c742f6f5c
SHA2564b5542a74f84d5c1bb5bd94741d7ea92a1d02887bcecdf8d54dce2ed5e77006b
SHA51285b0cc4cc9c67b329b025bd35f80188550cfb38113c92479e6ec60dc54f9343796ed0a323b39c3ea35c74d9056fcc73cca247b516d3a54fe904e9574bd1fd3f9
-
Filesize
72KB
MD5fcdbd5297289a915bd52e3b17875f7b7
SHA1300b999f55d85b1417dc27136be2909c1423bfdf
SHA2563b589af37480f9bf714e74df52d2bebd4ea81f872aa66b5db7e9318948270026
SHA5126803d1455545a9a76e665398e2fdf7b49b4ea73044e330892809b154aeeb9ab971f79c2486fd0be84feadd021759d7d2f640802e734571bfe23659844e55e3e2
-
Filesize
72KB
MD5fcdbd5297289a915bd52e3b17875f7b7
SHA1300b999f55d85b1417dc27136be2909c1423bfdf
SHA2563b589af37480f9bf714e74df52d2bebd4ea81f872aa66b5db7e9318948270026
SHA5126803d1455545a9a76e665398e2fdf7b49b4ea73044e330892809b154aeeb9ab971f79c2486fd0be84feadd021759d7d2f640802e734571bfe23659844e55e3e2
-
Filesize
72KB
MD5ba588a9bb4527230b4a2067b27d82438
SHA10ed4e0762f6beec13f3f34bad2661179bc726f5b
SHA2564c746c22e04496045b681503ba5269efb21b2083b49a794b8a3fe58d3de8f03f
SHA5120bd1a8f467cebda1c060febf92b10676cea5168967b9f8d7b1665320448484dd989db8a3eaeb341d8ce1bfcf7ebc2bf4dbe9fa201cba655b7a3547501a781e9d
-
Filesize
72KB
MD5ba588a9bb4527230b4a2067b27d82438
SHA10ed4e0762f6beec13f3f34bad2661179bc726f5b
SHA2564c746c22e04496045b681503ba5269efb21b2083b49a794b8a3fe58d3de8f03f
SHA5120bd1a8f467cebda1c060febf92b10676cea5168967b9f8d7b1665320448484dd989db8a3eaeb341d8ce1bfcf7ebc2bf4dbe9fa201cba655b7a3547501a781e9d
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD5c711ec7a3d49e53e5ffa0488ce249936
SHA107aa3d6f51c180ceccc0df259d06f2ba9ee49bdc
SHA25684a67950ccefc633a6177a5e0cceee2a16e37654c8d681c258b12cbe9e7fba6c
SHA512d4d1b9756a944531da29edf28035a4ea9ed57d98c3c9756d62fcc5c670cd57f02b6750a9ef8a4acc5333164cdba8d3825e7d45025b9d157b192c5861ed1335c4
-
Filesize
72KB
MD5c711ec7a3d49e53e5ffa0488ce249936
SHA107aa3d6f51c180ceccc0df259d06f2ba9ee49bdc
SHA25684a67950ccefc633a6177a5e0cceee2a16e37654c8d681c258b12cbe9e7fba6c
SHA512d4d1b9756a944531da29edf28035a4ea9ed57d98c3c9756d62fcc5c670cd57f02b6750a9ef8a4acc5333164cdba8d3825e7d45025b9d157b192c5861ed1335c4
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD5ee0b1ed0843fef00f0ab9ac0b14eb2db
SHA1291b7db93ec4ee0ad72b2ca0720b74d26fc2230a
SHA2565d22b0bb9027380dfdabd4a6318d51fb547e4bb7d78d5a91aa664cc8e22948d1
SHA512b78a4c75244a4a3b906539007441e07e394bc5dc68838fa19e8ce901fb8f49bda17bc73f31ec589c3243446c30a946c8caf08f14ccec8be205d1c1d2966fb2c5
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD52202403ef1cb709637638f48d3dfcf13
SHA131b59c55036512a849820c64dbed8c8a3f44c797
SHA256c45787b424d38c15ef82cf41c2b04906ed9ae7dd18fc8ac09f9152a299565d79
SHA512f7b97fef474059fdb91794b5ec57dd39e6ec659198d79f968d3142eaacbf004abed73a6eb0adbf507f42f1b2d8b445128b6441e7b74f8906ff1ceb70ab2d1fde
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5ede28c3d28a8b47cb2e5d245b00509e5
SHA11d0224311cbc5a32e354414bd4789d21374f8821
SHA25651cff1219d7db8a1559383ba401f15d7185ce9d32f5fed731720a93669f672a9
SHA512f94618cf6a07fe84343e973a06317302a79ed619d521f97bccdc6e581d379550586ecbe28c9025f5b700371fed1ccac964549bcc5e7488edaa26f6898e44045d
-
Filesize
72KB
MD5daedf02adbaf9e94c331df97585ba555
SHA11864b450379e3f7f814a5c4624f9f430931cd4d2
SHA256bfdda64b4fbb129b9cfb675808ba6ff3710d680fddb40bfb8a2a28037eac4b27
SHA512e39e855ff26387fd80b69126b3d6ebac62a1e4cebcdfc4f651b467d1382e5855f2c4c6fbd46992921039c069a831b0b38b32fc7cf8b7f6efecb0d53553808ec3
-
Filesize
72KB
MD5daedf02adbaf9e94c331df97585ba555
SHA11864b450379e3f7f814a5c4624f9f430931cd4d2
SHA256bfdda64b4fbb129b9cfb675808ba6ff3710d680fddb40bfb8a2a28037eac4b27
SHA512e39e855ff26387fd80b69126b3d6ebac62a1e4cebcdfc4f651b467d1382e5855f2c4c6fbd46992921039c069a831b0b38b32fc7cf8b7f6efecb0d53553808ec3
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD593db2080bf119d7f16c610ee67b5ad0b
SHA1f44451e599330f1b3327c1f10e707e776e513f37
SHA2566b38fbcee88098d79f37f58e0d9fc2f2aca5422aaf7d98a965a343290dbb0682
SHA51279928b0dc61e6863e29c1baf4fb04e3ec44093c0197b4d0fae703ce23ca16cf9dd0d5c14963598ad16a9bd61c6314c1e0886b813f0f5e637957a156861dfc4e4
-
Filesize
72KB
MD593db2080bf119d7f16c610ee67b5ad0b
SHA1f44451e599330f1b3327c1f10e707e776e513f37
SHA2566b38fbcee88098d79f37f58e0d9fc2f2aca5422aaf7d98a965a343290dbb0682
SHA51279928b0dc61e6863e29c1baf4fb04e3ec44093c0197b4d0fae703ce23ca16cf9dd0d5c14963598ad16a9bd61c6314c1e0886b813f0f5e637957a156861dfc4e4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD593db2080bf119d7f16c610ee67b5ad0b
SHA1f44451e599330f1b3327c1f10e707e776e513f37
SHA2566b38fbcee88098d79f37f58e0d9fc2f2aca5422aaf7d98a965a343290dbb0682
SHA51279928b0dc61e6863e29c1baf4fb04e3ec44093c0197b4d0fae703ce23ca16cf9dd0d5c14963598ad16a9bd61c6314c1e0886b813f0f5e637957a156861dfc4e4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD593db2080bf119d7f16c610ee67b5ad0b
SHA1f44451e599330f1b3327c1f10e707e776e513f37
SHA2566b38fbcee88098d79f37f58e0d9fc2f2aca5422aaf7d98a965a343290dbb0682
SHA51279928b0dc61e6863e29c1baf4fb04e3ec44093c0197b4d0fae703ce23ca16cf9dd0d5c14963598ad16a9bd61c6314c1e0886b813f0f5e637957a156861dfc4e4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5df6a9b3c84919d301f06050ee0e821a6
SHA1c2f942181df41da9df47654bab77ddaa29de1194
SHA256c8b0f066e9e46d636d22bafd31086e01e4fb794e72687f87e332a4ed8ebbbf11
SHA5120c643b1cbd194c62418a6d1fc313d19554ab917dcdf6397abb384a908b61896b85aa510f654713b460fe2858185d30b2366ed3c98a88d6847dace7b7ef18b55b
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5df6a9b3c84919d301f06050ee0e821a6
SHA1c2f942181df41da9df47654bab77ddaa29de1194
SHA256c8b0f066e9e46d636d22bafd31086e01e4fb794e72687f87e332a4ed8ebbbf11
SHA5120c643b1cbd194c62418a6d1fc313d19554ab917dcdf6397abb384a908b61896b85aa510f654713b460fe2858185d30b2366ed3c98a88d6847dace7b7ef18b55b
-
Filesize
72KB
MD5d6427d42f4719d0d01a526a4890ce3e7
SHA17a716e92eb3249cdba2647e485a5150c6ae86f7c
SHA256422a3dfbb4b96a9c23a817d1e45b266af6bd735af6b6ec92ec4d2a55f9953018
SHA5121a1bdaaa5ff8a9adbbb44d25b559ce4b0326486cfafc6e909702fadf567abb7a0d4c4d99e9a40820c1083fa1d3de87034b9e7b5ee1b698ead5464e4a01b34af5
-
Filesize
72KB
MD5d6427d42f4719d0d01a526a4890ce3e7
SHA17a716e92eb3249cdba2647e485a5150c6ae86f7c
SHA256422a3dfbb4b96a9c23a817d1e45b266af6bd735af6b6ec92ec4d2a55f9953018
SHA5121a1bdaaa5ff8a9adbbb44d25b559ce4b0326486cfafc6e909702fadf567abb7a0d4c4d99e9a40820c1083fa1d3de87034b9e7b5ee1b698ead5464e4a01b34af5
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD58da10c8cf1503cddfa12975d8c67c820
SHA1e9c5afe36069f3019a442f0bed08878941b59f06
SHA2563e7ea0bd66c316b4421d71b039f1ad661b1b00a97feed8738f7dbddd95c75a8b
SHA5123d4abc35b0cae2588cf68a2e0c887c0778a870ab70b0292c23322fd529879d40ca57275b7e6ec365254609416bbe4d1619efcf6395967040fc6483cdfc910696
-
Filesize
72KB
MD5f2dacd99234c9265f211651a22de0aee
SHA1ce7a2a79c1c8ed1b9d317f4df3a7c2ebfed53518
SHA2563b43dd47b6db769cacc3799d00f0252c4bf9b9f13146c83ccc0c006e24e7707f
SHA512cb9e7e4d190c63b10547c29ecf5546eea15a5f8fad518eb6999804247c846589be01a2f8f5ca7453fc3f513c02e3656c081e5c9ffa780b06591253e21f2bdd20
-
Filesize
72KB
MD5f2dacd99234c9265f211651a22de0aee
SHA1ce7a2a79c1c8ed1b9d317f4df3a7c2ebfed53518
SHA2563b43dd47b6db769cacc3799d00f0252c4bf9b9f13146c83ccc0c006e24e7707f
SHA512cb9e7e4d190c63b10547c29ecf5546eea15a5f8fad518eb6999804247c846589be01a2f8f5ca7453fc3f513c02e3656c081e5c9ffa780b06591253e21f2bdd20