Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 00:33
Static task
static1
Behavioral task
behavioral1
Sample
b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe
Resource
win10v2004-20220812-en
General
-
Target
b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe
-
Size
72KB
-
MD5
0480c390cf1c94cbbecfb0076f57cb10
-
SHA1
c9089ec389de980e2d47792cd78272c8d189cf0a
-
SHA256
b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096
-
SHA512
a69e73a8df4216c0f43159b6c55e20c5a81fa346775e024f66b33fee003e6a1fec20fdf7ee9dc2086a44318f1bd359d6abb471778fabe5b4e528747830640130
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2T:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPn
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1616 System Restore.exe 1136 backup.exe 1904 backup.exe 516 data.exe 896 backup.exe 1356 backup.exe 1140 backup.exe 604 System Restore.exe 576 backup.exe 1780 backup.exe 1776 backup.exe 928 backup.exe 872 backup.exe 984 backup.exe 2036 backup.exe 240 backup.exe 1976 backup.exe 1088 backup.exe 1400 backup.exe 1988 backup.exe 436 update.exe 1560 backup.exe 660 System Restore.exe 1556 update.exe 688 backup.exe 1260 backup.exe 1656 backup.exe 1384 backup.exe 288 backup.exe 584 backup.exe 320 backup.exe 1160 backup.exe 760 backup.exe 1648 backup.exe 928 backup.exe 684 backup.exe 2004 backup.exe 1148 backup.exe 1632 backup.exe 1624 backup.exe 1176 backup.exe 1428 backup.exe 1532 backup.exe 1608 System Restore.exe 1972 backup.exe 1268 backup.exe 772 backup.exe 1564 backup.exe 332 backup.exe 1560 backup.exe 1184 backup.exe 1592 System Restore.exe 1068 backup.exe 516 backup.exe 1492 backup.exe 1656 backup.exe 1724 backup.exe 1980 data.exe 432 backup.exe 960 backup.exe 1568 backup.exe 2044 backup.exe 1504 backup.exe 684 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1136 backup.exe 1136 backup.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 516 data.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 516 data.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1136 backup.exe 1136 backup.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 576 backup.exe 576 backup.exe 1780 backup.exe 1780 backup.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 576 backup.exe 576 backup.exe 984 backup.exe 984 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 436 update.exe 436 update.exe 436 update.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1556 update.exe 1556 update.exe 1556 update.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 1976 backup.exe 288 backup.exe 288 backup.exe 288 backup.exe 288 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe data.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 1616 System Restore.exe 1136 backup.exe 1904 backup.exe 516 data.exe 896 backup.exe 1356 backup.exe 1140 backup.exe 576 backup.exe 604 System Restore.exe 1780 backup.exe 1776 backup.exe 928 backup.exe 872 backup.exe 984 backup.exe 2036 backup.exe 240 backup.exe 1976 backup.exe 1088 backup.exe 1400 backup.exe 1988 backup.exe 436 update.exe 1560 backup.exe 660 System Restore.exe 1556 update.exe 688 backup.exe 1260 backup.exe 1656 backup.exe 1384 backup.exe 288 backup.exe 584 backup.exe 320 backup.exe 1160 backup.exe 760 backup.exe 1648 backup.exe 928 backup.exe 684 backup.exe 2004 backup.exe 1148 backup.exe 1632 backup.exe 1624 backup.exe 1176 backup.exe 1428 backup.exe 1608 System Restore.exe 1532 backup.exe 1972 backup.exe 1268 backup.exe 772 backup.exe 1564 backup.exe 332 backup.exe 1560 backup.exe 1184 backup.exe 1592 System Restore.exe 1068 backup.exe 516 backup.exe 1492 backup.exe 1656 backup.exe 1724 backup.exe 1980 data.exe 432 backup.exe 1568 backup.exe 2044 backup.exe 960 backup.exe 1504 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1616 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 28 PID 1500 wrote to memory of 1616 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 28 PID 1500 wrote to memory of 1616 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 28 PID 1500 wrote to memory of 1616 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 28 PID 1500 wrote to memory of 1904 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 29 PID 1500 wrote to memory of 1904 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 29 PID 1500 wrote to memory of 1904 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 29 PID 1500 wrote to memory of 1904 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 29 PID 1616 wrote to memory of 1136 1616 System Restore.exe 30 PID 1616 wrote to memory of 1136 1616 System Restore.exe 30 PID 1616 wrote to memory of 1136 1616 System Restore.exe 30 PID 1616 wrote to memory of 1136 1616 System Restore.exe 30 PID 1136 wrote to memory of 516 1136 backup.exe 31 PID 1136 wrote to memory of 516 1136 backup.exe 31 PID 1136 wrote to memory of 516 1136 backup.exe 31 PID 1136 wrote to memory of 516 1136 backup.exe 31 PID 1500 wrote to memory of 896 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 32 PID 1500 wrote to memory of 896 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 32 PID 1500 wrote to memory of 896 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 32 PID 1500 wrote to memory of 896 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 32 PID 1500 wrote to memory of 1356 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 33 PID 1500 wrote to memory of 1356 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 33 PID 1500 wrote to memory of 1356 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 33 PID 1500 wrote to memory of 1356 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 33 PID 516 wrote to memory of 1140 516 data.exe 34 PID 516 wrote to memory of 1140 516 data.exe 34 PID 516 wrote to memory of 1140 516 data.exe 34 PID 516 wrote to memory of 1140 516 data.exe 34 PID 1500 wrote to memory of 604 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 35 PID 1500 wrote to memory of 604 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 35 PID 1500 wrote to memory of 604 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 35 PID 1500 wrote to memory of 604 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 35 PID 1136 wrote to memory of 576 1136 backup.exe 36 PID 1136 wrote to memory of 576 1136 backup.exe 36 PID 1136 wrote to memory of 576 1136 backup.exe 36 PID 1136 wrote to memory of 576 1136 backup.exe 36 PID 1500 wrote to memory of 1776 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 37 PID 1500 wrote to memory of 1776 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 37 PID 1500 wrote to memory of 1776 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 37 PID 1500 wrote to memory of 1776 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 37 PID 576 wrote to memory of 1780 576 backup.exe 38 PID 576 wrote to memory of 1780 576 backup.exe 38 PID 576 wrote to memory of 1780 576 backup.exe 38 PID 576 wrote to memory of 1780 576 backup.exe 38 PID 1780 wrote to memory of 872 1780 backup.exe 39 PID 1780 wrote to memory of 872 1780 backup.exe 39 PID 1780 wrote to memory of 872 1780 backup.exe 39 PID 1780 wrote to memory of 872 1780 backup.exe 39 PID 1500 wrote to memory of 928 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 40 PID 1500 wrote to memory of 928 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 40 PID 1500 wrote to memory of 928 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 40 PID 1500 wrote to memory of 928 1500 b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe 40 PID 576 wrote to memory of 984 576 backup.exe 41 PID 576 wrote to memory of 984 576 backup.exe 41 PID 576 wrote to memory of 984 576 backup.exe 41 PID 576 wrote to memory of 984 576 backup.exe 41 PID 984 wrote to memory of 2036 984 backup.exe 42 PID 984 wrote to memory of 2036 984 backup.exe 42 PID 984 wrote to memory of 2036 984 backup.exe 42 PID 984 wrote to memory of 2036 984 backup.exe 42 PID 2036 wrote to memory of 240 2036 backup.exe 43 PID 2036 wrote to memory of 240 2036 backup.exe 43 PID 2036 wrote to memory of 240 2036 backup.exe 43 PID 2036 wrote to memory of 240 2036 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe"C:\Users\Admin\AppData\Local\Temp\b6081dc7c1ad74fdb21210927e41305a84c925dcdc3e84e64bf9288f94c61096.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2790629222\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\2790629222\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\2790629222\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\PerfLogs\data.exeC:\PerfLogs\data.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1140
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:984 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2036 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1400
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:436
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:660
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1656
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:288 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1148
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1428
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:772
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1184
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- System policy modification
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- System policy modification
PID:1088
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- System policy modification
PID:1280
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:2100
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵PID:2256
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:432 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
PID:1424
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1020
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1556
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1100
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:1348
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
PID:1112
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:2200
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:2316
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Program Files\Common Files\SpeechEngines\data.exe"C:\Program Files\Common Files\SpeechEngines\data.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1504
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1312 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1320 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1668
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:1792
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1652
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:2160
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2280
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:388
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1524
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:368
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1664
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1148
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2184
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2332
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1656 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2044
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:684
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1624
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- System policy modification
PID:1988
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1708
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:960
-
-
C:\Program Files\DVD Maker\Shared\data.exe"C:\Program Files\DVD Maker\Shared\data.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1904
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:632 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Drops file in Program Files directory
- System policy modification
PID:836 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:2016
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:2340
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1392
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:2144
-
-
C:\Program Files\Microsoft Games\data.exe"C:\Program Files\Microsoft Games\data.exe" C:\Program Files\Microsoft Games\5⤵PID:2308
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1160 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:928 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2004
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1632 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1176
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1608
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1268
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1564 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1604
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:876 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1960
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:660 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1516 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:472
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1860
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:1424
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:996
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:584
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2192
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1180 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1612 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1756
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1584
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:2216
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:2324
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:516
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1356 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1552
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:2152
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:2264
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1280
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2176
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2300
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1108
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2288
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1140 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:980 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- System policy modification
PID:964
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1000
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1292
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:2168
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2272
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1564
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1972
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:896
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1356
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:604
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1776
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:928
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c7cd29c9105aea923bfdaaf08f2f0a59
SHA1fbfcacc8a02682e903f760b735f65945fc250daa
SHA256437a5a1bcbce879dab1307f1864ecd7ad7734e613cf520c90cfe6eb2f5298206
SHA51258674058642f532eaf5e904d65932d2ad6f56413850d879ff0f219162722436c59642f1eff749c29474b2b60f766aa0e5b6ae8487b04b95c469e0454696eeef9
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD5dded90ace36063d10b025088e08d0aff
SHA1830322d77fba3118eddd0932858a3af37c4e3cf7
SHA25613120e055c6715da3909e26691b6be900f02d0d5a58fe952d59016cc5485725f
SHA512d0f9f9238b64ca3f6534ef961484efe584a89eb9c86d98d0473122c475d03b1df3659f485ca4e7b65786ec854db40575118000d6f1915ab533547c7051d1cd07
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD5dded90ace36063d10b025088e08d0aff
SHA1830322d77fba3118eddd0932858a3af37c4e3cf7
SHA25613120e055c6715da3909e26691b6be900f02d0d5a58fe952d59016cc5485725f
SHA512d0f9f9238b64ca3f6534ef961484efe584a89eb9c86d98d0473122c475d03b1df3659f485ca4e7b65786ec854db40575118000d6f1915ab533547c7051d1cd07
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD58f75ac2a6fe8e73ef5a8e3676d717746
SHA17ea7565a771667ea14f0469af6f019023391d3e0
SHA256ff38e64a9aae7759e19a719dcaf76f2c1f11fa7c6d7399b9523e49a9233e1f03
SHA512fc653af21ce1603a0ccd730c72d8d5abae3296ed7bccbf6e30b6c6ee32e393d0d5c2e3bef093ca50ad056a4c3c48ba944b9b9e5c714d70b2b5973a64634946fe
-
Filesize
72KB
MD58f75ac2a6fe8e73ef5a8e3676d717746
SHA17ea7565a771667ea14f0469af6f019023391d3e0
SHA256ff38e64a9aae7759e19a719dcaf76f2c1f11fa7c6d7399b9523e49a9233e1f03
SHA512fc653af21ce1603a0ccd730c72d8d5abae3296ed7bccbf6e30b6c6ee32e393d0d5c2e3bef093ca50ad056a4c3c48ba944b9b9e5c714d70b2b5973a64634946fe
-
Filesize
72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
Filesize
72KB
MD598eda9ffe66b31a37e72772daf35c258
SHA1d74c9855ca11e178cafe9ef41794f0f1132b2f02
SHA25675c15a142c2b7bde9c01a0cd8cc0bff9bd375dfa80d586b5bb7a87d298f541e2
SHA512e326b54b1a9c75370f9ddc0dbb9c2f0f182f8ecb2463a74454f1a91bf82c05683a55bf37cb897f3b4159a2bd14b56769c56b30567ac1da4c7e0801f87b5e3424
-
Filesize
72KB
MD5907475e266dbe5970ff9d682dc731b3d
SHA1072d68a8d3ed5b954581105196669ed525fe5022
SHA25642afb013504bb82d59d9c06cb29543b95155b78ddb7cee85f0ce26fbbb5897b4
SHA512386c8bdf4cf87d087b0aa252ebfbff0ff79e89a9f0255c293b314289432c3260451d841ea591dfb4d464e01792724c3689e3c4ca816affea5501fc50cde53866
-
Filesize
72KB
MD598eda9ffe66b31a37e72772daf35c258
SHA1d74c9855ca11e178cafe9ef41794f0f1132b2f02
SHA25675c15a142c2b7bde9c01a0cd8cc0bff9bd375dfa80d586b5bb7a87d298f541e2
SHA512e326b54b1a9c75370f9ddc0dbb9c2f0f182f8ecb2463a74454f1a91bf82c05683a55bf37cb897f3b4159a2bd14b56769c56b30567ac1da4c7e0801f87b5e3424
-
Filesize
72KB
MD584decf9616dccb8f167c86642a16631a
SHA1acd66da60aeb7ef5e706a430dad9da59f0223397
SHA256dc95fe576b67fa55c2e24b345581a9ef749ef56afa279ffc912ff3b24c4f6176
SHA512da77461c89ba04ab1e4cb6db9a4ebe2a6ad40798d9a383131cdeb2432914bfd493dc47e9daa31c33ae11814fca2cc5e8116cc020f1765347826f9ac3c4c439eb
-
Filesize
72KB
MD584decf9616dccb8f167c86642a16631a
SHA1acd66da60aeb7ef5e706a430dad9da59f0223397
SHA256dc95fe576b67fa55c2e24b345581a9ef749ef56afa279ffc912ff3b24c4f6176
SHA512da77461c89ba04ab1e4cb6db9a4ebe2a6ad40798d9a383131cdeb2432914bfd493dc47e9daa31c33ae11814fca2cc5e8116cc020f1765347826f9ac3c4c439eb
-
Filesize
72KB
MD5c7cd29c9105aea923bfdaaf08f2f0a59
SHA1fbfcacc8a02682e903f760b735f65945fc250daa
SHA256437a5a1bcbce879dab1307f1864ecd7ad7734e613cf520c90cfe6eb2f5298206
SHA51258674058642f532eaf5e904d65932d2ad6f56413850d879ff0f219162722436c59642f1eff749c29474b2b60f766aa0e5b6ae8487b04b95c469e0454696eeef9
-
Filesize
72KB
MD5c7cd29c9105aea923bfdaaf08f2f0a59
SHA1fbfcacc8a02682e903f760b735f65945fc250daa
SHA256437a5a1bcbce879dab1307f1864ecd7ad7734e613cf520c90cfe6eb2f5298206
SHA51258674058642f532eaf5e904d65932d2ad6f56413850d879ff0f219162722436c59642f1eff749c29474b2b60f766aa0e5b6ae8487b04b95c469e0454696eeef9
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD55320fbd19e84d98ba92ca69727c88ce6
SHA1268ac0c399170b2ab9c15edfac8cbfd0b269d55c
SHA256711451547c035d402b5a29bd346b0ff8a7abf453e14d829df76c9a25c1e33fd7
SHA512a8dc8ee92c66701d5219ecf30b88c08dff5c75eed93e1bbb262287eabd0b8ed8491d1ff820b6f4378a0660dd1f1384449effbe3be50111c5c3d11668491d9a6f
-
Filesize
72KB
MD5dded90ace36063d10b025088e08d0aff
SHA1830322d77fba3118eddd0932858a3af37c4e3cf7
SHA25613120e055c6715da3909e26691b6be900f02d0d5a58fe952d59016cc5485725f
SHA512d0f9f9238b64ca3f6534ef961484efe584a89eb9c86d98d0473122c475d03b1df3659f485ca4e7b65786ec854db40575118000d6f1915ab533547c7051d1cd07
-
Filesize
72KB
MD5dded90ace36063d10b025088e08d0aff
SHA1830322d77fba3118eddd0932858a3af37c4e3cf7
SHA25613120e055c6715da3909e26691b6be900f02d0d5a58fe952d59016cc5485725f
SHA512d0f9f9238b64ca3f6534ef961484efe584a89eb9c86d98d0473122c475d03b1df3659f485ca4e7b65786ec854db40575118000d6f1915ab533547c7051d1cd07
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD5dfb40a8ecf7fc5538ada9d2a1b212816
SHA1699002ed403350b2959da9139f842e579a349c54
SHA256a271a327e2f4088f4315083d54e693049c6cdb5acb9f36dae24c5b4800a3b844
SHA512f61a775c21cf9311fd9fea8701fa68268974f3445a88ccc4977334b5fcb1db0a166ff9e27ca17dc96e84dcff8af168dcc359fbe0f33b64b180092923cdec88dd
-
Filesize
72KB
MD5dded90ace36063d10b025088e08d0aff
SHA1830322d77fba3118eddd0932858a3af37c4e3cf7
SHA25613120e055c6715da3909e26691b6be900f02d0d5a58fe952d59016cc5485725f
SHA512d0f9f9238b64ca3f6534ef961484efe584a89eb9c86d98d0473122c475d03b1df3659f485ca4e7b65786ec854db40575118000d6f1915ab533547c7051d1cd07
-
Filesize
72KB
MD5dded90ace36063d10b025088e08d0aff
SHA1830322d77fba3118eddd0932858a3af37c4e3cf7
SHA25613120e055c6715da3909e26691b6be900f02d0d5a58fe952d59016cc5485725f
SHA512d0f9f9238b64ca3f6534ef961484efe584a89eb9c86d98d0473122c475d03b1df3659f485ca4e7b65786ec854db40575118000d6f1915ab533547c7051d1cd07
-
Filesize
72KB
MD534db1529cf237af71233dd129aff3d14
SHA1abb05381ec1e73fe21bd24f4ba1ef0d529199999
SHA256b3cc7f13d71cc888c937f77396c5ab91e04a1351c7e4693934fe8a5957597071
SHA512573b700909c1e001641b1f18b85b3cfe5a3dd12ad0c6be5dc9e2c68dca250d0089445665265f6132b7dcc1a5db1bdac6512d7651b201ac0594b8464ab1946b7b
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD502104fa55883459fc469032417a7359a
SHA17b5138e105cdfdb307db4298f3ad94718e655bc6
SHA256b7b7859bb97647456eca14e610dff5572b5d8ea31d4e692f8259bacc9a2fbbfb
SHA512857e9c0af893157454d5a7d6d3da3f389f0382ba3d620d70fd3ed72900977c95e637b8df06d4e466d04d64e504c2f9891859a185b66ceca31d68ecf70568261c
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD577a56c1067107fb76514f83bb07b7744
SHA1bdc1bbe01423365cacee70615df69f086b9fe1a3
SHA256c982f3180e83c338180166c870dea7120f891101c746e2632e162688d9fd478e
SHA512bb8230d0883e211c7df10daa9d6922ca755da6351ae6895615e7fb4228d3f5f4a36d50c394216dd24ea0547ac78a26a1923f670e54db85c0b0234708727f45f6
-
Filesize
72KB
MD58f75ac2a6fe8e73ef5a8e3676d717746
SHA17ea7565a771667ea14f0469af6f019023391d3e0
SHA256ff38e64a9aae7759e19a719dcaf76f2c1f11fa7c6d7399b9523e49a9233e1f03
SHA512fc653af21ce1603a0ccd730c72d8d5abae3296ed7bccbf6e30b6c6ee32e393d0d5c2e3bef093ca50ad056a4c3c48ba944b9b9e5c714d70b2b5973a64634946fe
-
Filesize
72KB
MD58f75ac2a6fe8e73ef5a8e3676d717746
SHA17ea7565a771667ea14f0469af6f019023391d3e0
SHA256ff38e64a9aae7759e19a719dcaf76f2c1f11fa7c6d7399b9523e49a9233e1f03
SHA512fc653af21ce1603a0ccd730c72d8d5abae3296ed7bccbf6e30b6c6ee32e393d0d5c2e3bef093ca50ad056a4c3c48ba944b9b9e5c714d70b2b5973a64634946fe
-
Filesize
72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
Filesize
72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5b11aff62ea7fe7503338b2f30de3e8f6
SHA11a23e0f675022396a84e79994bf54afebb4713ae
SHA256be6a0ad15df04eaaf7217c59506fa50de6aabe548fea46ca0bc604a0c363202c
SHA512ea63672b87c8514834d580879eb1e1637a58db45c2ad4a7f00a502b3d55a22c364c555c25088c4c5634ed95ad3c2aedb643f136df00e1edbe38fcb66da4749b2
-
Filesize
72KB
MD598eda9ffe66b31a37e72772daf35c258
SHA1d74c9855ca11e178cafe9ef41794f0f1132b2f02
SHA25675c15a142c2b7bde9c01a0cd8cc0bff9bd375dfa80d586b5bb7a87d298f541e2
SHA512e326b54b1a9c75370f9ddc0dbb9c2f0f182f8ecb2463a74454f1a91bf82c05683a55bf37cb897f3b4159a2bd14b56769c56b30567ac1da4c7e0801f87b5e3424
-
Filesize
72KB
MD598eda9ffe66b31a37e72772daf35c258
SHA1d74c9855ca11e178cafe9ef41794f0f1132b2f02
SHA25675c15a142c2b7bde9c01a0cd8cc0bff9bd375dfa80d586b5bb7a87d298f541e2
SHA512e326b54b1a9c75370f9ddc0dbb9c2f0f182f8ecb2463a74454f1a91bf82c05683a55bf37cb897f3b4159a2bd14b56769c56b30567ac1da4c7e0801f87b5e3424
-
Filesize
72KB
MD5907475e266dbe5970ff9d682dc731b3d
SHA1072d68a8d3ed5b954581105196669ed525fe5022
SHA25642afb013504bb82d59d9c06cb29543b95155b78ddb7cee85f0ce26fbbb5897b4
SHA512386c8bdf4cf87d087b0aa252ebfbff0ff79e89a9f0255c293b314289432c3260451d841ea591dfb4d464e01792724c3689e3c4ca816affea5501fc50cde53866
-
Filesize
72KB
MD5907475e266dbe5970ff9d682dc731b3d
SHA1072d68a8d3ed5b954581105196669ed525fe5022
SHA25642afb013504bb82d59d9c06cb29543b95155b78ddb7cee85f0ce26fbbb5897b4
SHA512386c8bdf4cf87d087b0aa252ebfbff0ff79e89a9f0255c293b314289432c3260451d841ea591dfb4d464e01792724c3689e3c4ca816affea5501fc50cde53866
-
Filesize
72KB
MD598eda9ffe66b31a37e72772daf35c258
SHA1d74c9855ca11e178cafe9ef41794f0f1132b2f02
SHA25675c15a142c2b7bde9c01a0cd8cc0bff9bd375dfa80d586b5bb7a87d298f541e2
SHA512e326b54b1a9c75370f9ddc0dbb9c2f0f182f8ecb2463a74454f1a91bf82c05683a55bf37cb897f3b4159a2bd14b56769c56b30567ac1da4c7e0801f87b5e3424
-
Filesize
72KB
MD598eda9ffe66b31a37e72772daf35c258
SHA1d74c9855ca11e178cafe9ef41794f0f1132b2f02
SHA25675c15a142c2b7bde9c01a0cd8cc0bff9bd375dfa80d586b5bb7a87d298f541e2
SHA512e326b54b1a9c75370f9ddc0dbb9c2f0f182f8ecb2463a74454f1a91bf82c05683a55bf37cb897f3b4159a2bd14b56769c56b30567ac1da4c7e0801f87b5e3424