Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe
Resource
win10v2004-20220812-en
General
-
Target
2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe
-
Size
72KB
-
MD5
087f88dbd1883b2180c69222f6d670be
-
SHA1
baad7945be33d1e2c06843710d778ad54d3ffb76
-
SHA256
2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba
-
SHA512
3dc9ff7d89c9a5c048b4d21f948c4626e17e8002240d9a5a24ed960b094fd18f4fda942b00cd7090dcc82853ffb61d19702eda118ea0453627e8fa620b872cde
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2G:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1528 backup.exe 2036 backup.exe 1988 backup.exe 1728 backup.exe 1908 backup.exe 1368 data.exe 1760 backup.exe 1272 System Restore.exe 328 backup.exe 648 backup.exe 1928 backup.exe 272 backup.exe 1952 backup.exe 1380 backup.exe 1616 backup.exe 1888 backup.exe 532 backup.exe 1060 backup.exe 2040 System Restore.exe 2028 data.exe 1968 update.exe 1720 backup.exe 1724 backup.exe 1960 backup.exe 1872 backup.exe 888 backup.exe 1760 backup.exe 1080 backup.exe 364 backup.exe 1900 backup.exe 268 backup.exe 1456 backup.exe 816 backup.exe 1896 backup.exe 1084 backup.exe 432 backup.exe 1808 backup.exe 1952 backup.exe 880 backup.exe 240 backup.exe 2000 backup.exe 1332 backup.exe 1500 backup.exe 1692 backup.exe 972 backup.exe 2032 backup.exe 2044 data.exe 2028 backup.exe 1972 backup.exe 520 System Restore.exe 1092 backup.exe 1724 data.exe 1108 backup.exe 1752 backup.exe 1368 backup.exe 784 backup.exe 1816 backup.exe 1104 data.exe 1912 backup.exe 468 backup.exe 1956 System Restore.exe 1904 backup.exe 316 backup.exe 944 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1272 System Restore.exe 1272 System Restore.exe 328 backup.exe 328 backup.exe 1272 System Restore.exe 1272 System Restore.exe 1928 backup.exe 1928 backup.exe 272 backup.exe 272 backup.exe 1928 backup.exe 1928 backup.exe 1380 backup.exe 1380 backup.exe 1616 backup.exe 1616 backup.exe 1616 backup.exe 1616 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 1968 update.exe 1968 update.exe 1968 update.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 532 backup.exe 1928 backup.exe 1616 backup.exe 1928 backup.exe 1380 backup.exe 1616 backup.exe 532 backup.exe 1272 System Restore.exe 532 backup.exe 1272 System Restore.exe 1380 backup.exe 1760 backup.exe 1760 backup.exe 532 backup.exe 532 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\System Restore.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\update.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe data.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe System Restore.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe System Restore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 1528 backup.exe 2036 backup.exe 1988 backup.exe 1728 backup.exe 1908 backup.exe 1368 data.exe 1760 backup.exe 1272 System Restore.exe 328 backup.exe 648 backup.exe 1928 backup.exe 272 backup.exe 1952 backup.exe 1380 backup.exe 1616 backup.exe 1888 backup.exe 532 backup.exe 1060 backup.exe 2040 System Restore.exe 2028 data.exe 1968 update.exe 1720 backup.exe 1724 backup.exe 1960 backup.exe 1872 backup.exe 1760 backup.exe 1080 backup.exe 1900 backup.exe 364 backup.exe 888 backup.exe 268 backup.exe 1456 backup.exe 816 backup.exe 1896 backup.exe 1084 backup.exe 432 backup.exe 1808 backup.exe 240 backup.exe 2000 backup.exe 1952 backup.exe 880 backup.exe 1332 backup.exe 1500 backup.exe 972 backup.exe 1692 backup.exe 2032 backup.exe 2044 data.exe 2028 backup.exe 1972 backup.exe 520 System Restore.exe 1092 backup.exe 1724 data.exe 1108 backup.exe 1752 backup.exe 1368 backup.exe 784 backup.exe 1816 backup.exe 1104 data.exe 1912 backup.exe 468 backup.exe 1956 System Restore.exe 316 backup.exe 1904 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1528 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 27 PID 1788 wrote to memory of 1528 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 27 PID 1788 wrote to memory of 1528 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 27 PID 1788 wrote to memory of 1528 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 27 PID 1788 wrote to memory of 2036 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 28 PID 1788 wrote to memory of 2036 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 28 PID 1788 wrote to memory of 2036 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 28 PID 1788 wrote to memory of 2036 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 28 PID 1788 wrote to memory of 1988 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 29 PID 1788 wrote to memory of 1988 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 29 PID 1788 wrote to memory of 1988 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 29 PID 1788 wrote to memory of 1988 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 29 PID 1788 wrote to memory of 1728 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 30 PID 1788 wrote to memory of 1728 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 30 PID 1788 wrote to memory of 1728 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 30 PID 1788 wrote to memory of 1728 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 30 PID 1788 wrote to memory of 1908 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 31 PID 1788 wrote to memory of 1908 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 31 PID 1788 wrote to memory of 1908 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 31 PID 1788 wrote to memory of 1908 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 31 PID 1788 wrote to memory of 1368 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 32 PID 1788 wrote to memory of 1368 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 32 PID 1788 wrote to memory of 1368 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 32 PID 1788 wrote to memory of 1368 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 32 PID 1788 wrote to memory of 1760 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 33 PID 1788 wrote to memory of 1760 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 33 PID 1788 wrote to memory of 1760 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 33 PID 1788 wrote to memory of 1760 1788 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe 33 PID 1528 wrote to memory of 1272 1528 backup.exe 34 PID 1528 wrote to memory of 1272 1528 backup.exe 34 PID 1528 wrote to memory of 1272 1528 backup.exe 34 PID 1528 wrote to memory of 1272 1528 backup.exe 34 PID 1272 wrote to memory of 328 1272 System Restore.exe 35 PID 1272 wrote to memory of 328 1272 System Restore.exe 35 PID 1272 wrote to memory of 328 1272 System Restore.exe 35 PID 1272 wrote to memory of 328 1272 System Restore.exe 35 PID 328 wrote to memory of 648 328 backup.exe 36 PID 328 wrote to memory of 648 328 backup.exe 36 PID 328 wrote to memory of 648 328 backup.exe 36 PID 328 wrote to memory of 648 328 backup.exe 36 PID 1272 wrote to memory of 1928 1272 System Restore.exe 37 PID 1272 wrote to memory of 1928 1272 System Restore.exe 37 PID 1272 wrote to memory of 1928 1272 System Restore.exe 37 PID 1272 wrote to memory of 1928 1272 System Restore.exe 37 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1616 wrote to memory of 1888 1616 backup.exe 42 PID 1616 wrote to memory of 1888 1616 backup.exe 42 PID 1616 wrote to memory of 1888 1616 backup.exe 42 PID 1616 wrote to memory of 1888 1616 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe"C:\Users\Admin\AppData\Local\Temp\2a60047a8f827216d2a388fdfb6145fb20c5fbd8e35d942d658f27f9c4c9b5ba.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2728790659\backup.exeC:\Users\Admin\AppData\Local\Temp\2728790659\backup.exe C:\Users\Admin\AppData\Local\Temp\2728790659\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\System Restore.exe"\System Restore.exe" \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1380 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:532 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:880
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1096
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
PID:1712
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- System policy modification
PID:1916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
PID:1060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1264
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1368
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:1912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- System policy modification
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- System policy modification
PID:1820
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1184
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
PID:936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵PID:1556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵PID:1136
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1808
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:316
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1152
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\update.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\update.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2008
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1964 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- System policy modification
PID:1432
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1476
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:1808
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:932 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- System policy modification
PID:1084
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:728
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1596
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- System policy modification
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1052
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:1336
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:364
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:816 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:240
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Program Files\Common Files\System\ado\data.exe"C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1724 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1368
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:468
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1552
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:816
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2040
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1312
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:1480
-
-
C:\Program Files\Common Files\System\en-US\data.exe"C:\Program Files\Common Files\System\en-US\data.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1948
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- System policy modification
PID:1320
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
PID:1140
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- System policy modification
PID:1500
-
-
C:\Program Files\Common Files\System\ja-JP\update.exe"C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Modifies visibility of file extensions in Explorer
PID:1724
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:748 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1832
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵PID:1500
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵PID:1816
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵
- System policy modification
PID:1060
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- System policy modification
PID:964
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:584
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1704
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:888 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1500
-
-
C:\Program Files\DVD Maker\fr-FR\System Restore.exe"C:\Program Files\DVD Maker\fr-FR\System Restore.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Program Files\DVD Maker\ja-JP\System Restore.exe"C:\Program Files\DVD Maker\ja-JP\System Restore.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1956
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:944 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1888 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
PID:1488
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1556
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1892
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1956
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
PID:1156
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- System policy modification
PID:1952
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:980
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- System policy modification
PID:728
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
- Disables RegEdit via registry modification
PID:1476
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
- Modifies visibility of file extensions in Explorer
PID:880
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:268
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵
- System policy modification
PID:980
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1936
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:1476
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵PID:1972
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵PID:1276
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
PID:2024 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- System policy modification
PID:1328 -
C:\Program Files\Google\Chrome\Application\data.exe"C:\Program Files\Google\Chrome\Application\data.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:968 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
PID:832 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
PID:1724
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
PID:1552
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
PID:1152
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵PID:520
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵PID:1208
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1820
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1488
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:512
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1312
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1380
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1896 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1108
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
PID:1992
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
PID:272 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1052
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:1720
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1708
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Disables RegEdit via registry modification
PID:1608
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
PID:1276
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1740 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1488 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
PID:1948
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:240
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2012 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Disables RegEdit via registry modification
PID:584
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1980 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵PID:1080
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Disables RegEdit via registry modification
PID:468 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
PID:1880
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:540
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:680
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1712
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1684
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1468 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1996
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:816
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:520
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
PID:1456 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- Disables RegEdit via registry modification
PID:1824
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Drops file in Program Files directory
PID:1380 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- System policy modification
PID:1208 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵PID:1332
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:272
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2008
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵PID:1332
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1956
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:932
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:952 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1136 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:512
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1108 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:328 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1968 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵
- Disables RegEdit via registry modification
PID:520
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- System policy modification
PID:316
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:816
-
-
C:\Program Files (x86)\Common Files\DESIGNER\data.exe"C:\Program Files (x86)\Common Files\DESIGNER\data.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1984
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:728
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1056
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1080
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:748
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1284
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1760
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
PID:1604 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Disables RegEdit via registry modification
PID:468
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
PID:1100
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Disables RegEdit via registry modification
PID:1264
-
-
C:\Users\Admin\Downloads\update.exeC:\Users\Admin\Downloads\update.exe C:\Users\Admin\Downloads\6⤵
- System policy modification
PID:1056
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1916
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- System policy modification
PID:680
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:1500
-
-
C:\Users\Admin\Pictures\update.exeC:\Users\Admin\Pictures\update.exe C:\Users\Admin\Pictures\6⤵
- Disables RegEdit via registry modification
PID:1756
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:980
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:1904
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵PID:1456
-
-
-
C:\Users\Public\data.exeC:\Users\Public\data.exe C:\Users\Public\5⤵PID:1896
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1492
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1372
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5b82f3aaefc8c7996db1d5e825547875e
SHA1163946f23b9e2eed9e782030014236b21b9d3243
SHA25650f5e0c6bb51c34f95945041d13e2c451f14fcebb26af6564e03a1c152f5c2d6
SHA51252edcfe57d3588e22e3b8093b494b59cfda15234f7d96f7cf5b84fbf321d8cfe0590c40e35df6cc471227e3d96a03e14b232d7e521e02935ad7f3a2acad9024d
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5dbb20dde43b0fcfcd35d755a10f6f874
SHA1fe2a61a8e523ada6253303bce02c3d1be07029a8
SHA256928a1179ee498e4b9dc1a9a61ef61972aa7d7238bd9e6afcf69848407b4122d8
SHA512022f0d0f99dbbdf6142bdd15f8309eda58cc18f0428a00d8386964d3fea5c12b2550b5dc4b4f94046511821cd103c94c404927e3041e72a67a374dfc250b6ec5
-
Filesize
72KB
MD5dbb20dde43b0fcfcd35d755a10f6f874
SHA1fe2a61a8e523ada6253303bce02c3d1be07029a8
SHA256928a1179ee498e4b9dc1a9a61ef61972aa7d7238bd9e6afcf69848407b4122d8
SHA512022f0d0f99dbbdf6142bdd15f8309eda58cc18f0428a00d8386964d3fea5c12b2550b5dc4b4f94046511821cd103c94c404927e3041e72a67a374dfc250b6ec5
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5157d2c6ddfcba6f6c46c71627679e966
SHA1dd68d33f38f48337a329ec95849621b5b13f9328
SHA25646aaa2b23cc36e4936a357899fe74e90805f6fc900de7641f2fe751d7a2fb7c5
SHA512070da8b67d360604e6b8a23bb6e4adca1f3cc44c85f30364e2991f2d2006cee362c9be1b9e0c9591d2706b8548e5b4437302c22c4c76aae063d2090e504e49a3
-
Filesize
72KB
MD5157d2c6ddfcba6f6c46c71627679e966
SHA1dd68d33f38f48337a329ec95849621b5b13f9328
SHA25646aaa2b23cc36e4936a357899fe74e90805f6fc900de7641f2fe751d7a2fb7c5
SHA512070da8b67d360604e6b8a23bb6e4adca1f3cc44c85f30364e2991f2d2006cee362c9be1b9e0c9591d2706b8548e5b4437302c22c4c76aae063d2090e504e49a3
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5b82f3aaefc8c7996db1d5e825547875e
SHA1163946f23b9e2eed9e782030014236b21b9d3243
SHA25650f5e0c6bb51c34f95945041d13e2c451f14fcebb26af6564e03a1c152f5c2d6
SHA51252edcfe57d3588e22e3b8093b494b59cfda15234f7d96f7cf5b84fbf321d8cfe0590c40e35df6cc471227e3d96a03e14b232d7e521e02935ad7f3a2acad9024d
-
Filesize
72KB
MD5b82f3aaefc8c7996db1d5e825547875e
SHA1163946f23b9e2eed9e782030014236b21b9d3243
SHA25650f5e0c6bb51c34f95945041d13e2c451f14fcebb26af6564e03a1c152f5c2d6
SHA51252edcfe57d3588e22e3b8093b494b59cfda15234f7d96f7cf5b84fbf321d8cfe0590c40e35df6cc471227e3d96a03e14b232d7e521e02935ad7f3a2acad9024d
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5a1567b22ec1f14783cdd70459d28a88f
SHA11129b9092d286d411d8f86e2911ead7ffd32ed5b
SHA256d6726964ad14ebf5c16623f8dad6355335978f71caede405b196fc16e8accb70
SHA51259f07ef1141974fd783d0e604c9b660a71c073a2ab4d60402ccef81b37385a714d5c2f441a0ef49e1f6aedcf44bd930b68db2f50297ce128e83513e5d24b43a8
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5dbb20dde43b0fcfcd35d755a10f6f874
SHA1fe2a61a8e523ada6253303bce02c3d1be07029a8
SHA256928a1179ee498e4b9dc1a9a61ef61972aa7d7238bd9e6afcf69848407b4122d8
SHA512022f0d0f99dbbdf6142bdd15f8309eda58cc18f0428a00d8386964d3fea5c12b2550b5dc4b4f94046511821cd103c94c404927e3041e72a67a374dfc250b6ec5
-
Filesize
72KB
MD5dbb20dde43b0fcfcd35d755a10f6f874
SHA1fe2a61a8e523ada6253303bce02c3d1be07029a8
SHA256928a1179ee498e4b9dc1a9a61ef61972aa7d7238bd9e6afcf69848407b4122d8
SHA512022f0d0f99dbbdf6142bdd15f8309eda58cc18f0428a00d8386964d3fea5c12b2550b5dc4b4f94046511821cd103c94c404927e3041e72a67a374dfc250b6ec5
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5ba2dd53dd23075c37ddd525262222683
SHA19011b1cd3864b58b360abc44275f22385af15dde
SHA256b6e6614d7d0459ca9584cf7f8a5aeda901aaf63e0aa0eaf1ba5f0739e49c88a6
SHA512955dc88bb378839b47252ef5a715f5876bb21bdb583e3ac498bd02bbe0c681d9ef1154669c6a2ae2867fa3b01c6211bd1c916199e4e735c1e9a220a8e1e90ecf
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5ebf5aed6f97b95d6056308f387f02cfc
SHA10791d4641402b4effdbf81406814e2be5f7de664
SHA256c303986247c218f65f16616000576cd7878f0bce757773a4141b5db1215875be
SHA5124bfccd8a8317910df19adcbc2618628007df22aee8ffd90b8549af6130b7b1b555fa3050c37d318a760c91bcfabefbd6204e2d9f6ccb3c3841a3360655f0db4a
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5dee241ce0ecf59e563dedfa9580ac1e6
SHA18f22c9dc2d2b049b9c78ad51f606ef1a1de33472
SHA256a0508a4688353847506b79ec78b7a8e4c075f087bdd6541077f72a05cc04dd32
SHA5124c142fa31998ee53345349ef80fc240a9cc7822aa5a815c122fe4d4987bdee001e406b9e61790614a67e6daa6c784e9fe6a2f9a01d091301268dc3a8f81d747f
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD5e352680b416a942c603518d2c2182437
SHA1c25bae3c9028710c3f78a63d3c1ab3a33d564875
SHA256940f0c32df2030adf3fd1de67ed3db84adddf6b7834ec9e9b9a2a61b0acdf987
SHA512d43db70ea62f2131a869949a693095f5680ba57f1905c0495d917ba76b9a7e5f2db4ee767a5fadff672d888418e194bca8aaf46a379322b0608d9ad78da657b0
-
Filesize
72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42
-
Filesize
72KB
MD56f3f8653d4f1a3e67b57c8c3fbb48d45
SHA186c1e971e5c31a2b1b96c1fa29d1f45883664bf7
SHA2560cf018d5e099bd255c4d70b1cb61842f658ccf0380d3b0a238de43f31090d3c5
SHA512d229b9c763793f0f8432daf27c0c6f046d2819842e52260ec8b20657cd3be23c0f698a99684e47436a6339e471061c785fcb544f77de5a54ee43eabec4d9bf42