Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe
Resource
win10v2004-20220812-en
General
-
Target
ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe
-
Size
72KB
-
MD5
0f135b6d9d3400dc892ded47e4af3fdb
-
SHA1
3b81b96090e86430389e09ada825316fa567a4d8
-
SHA256
ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c
-
SHA512
4296b8d55aaf3de00beaf690c9f713ebe78c55c6af5d712c12f3ce6f0698d3c1674910a0dda72825939dc570f8848c707dfe1fbc142d19367d9bca257dc3a2f3
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2d:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrh
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 952 backup.exe 1692 backup.exe 1512 update.exe 1980 backup.exe 1340 backup.exe 700 backup.exe 1380 backup.exe 868 backup.exe 972 backup.exe 1712 backup.exe 1064 data.exe 1528 backup.exe 1472 backup.exe 1736 backup.exe 612 backup.exe 108 backup.exe 1616 data.exe 1684 backup.exe 1676 backup.exe 1348 backup.exe 1048 backup.exe 436 backup.exe 596 backup.exe 1680 backup.exe 676 backup.exe 588 backup.exe 1148 backup.exe 1352 backup.exe 320 backup.exe 1720 backup.exe 1768 backup.exe 1924 backup.exe 1776 backup.exe 1828 backup.exe 1004 backup.exe 1524 backup.exe 1112 backup.exe 1868 backup.exe 1456 backup.exe 1700 backup.exe 584 backup.exe 996 backup.exe 824 backup.exe 1628 backup.exe 1672 backup.exe 1588 backup.exe 872 backup.exe 1284 backup.exe 1692 backup.exe 1592 backup.exe 556 backup.exe 1580 update.exe 768 backup.exe 588 backup.exe 700 backup.exe 1252 backup.exe 1068 backup.exe 1800 backup.exe 1324 backup.exe 580 backup.exe 268 backup.exe 784 backup.exe 1688 backup.exe 1528 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1512 update.exe 1512 update.exe 1512 update.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 868 backup.exe 868 backup.exe 972 backup.exe 972 backup.exe 868 backup.exe 868 backup.exe 1064 data.exe 1064 data.exe 1528 backup.exe 1528 backup.exe 1064 data.exe 1064 data.exe 1736 backup.exe 1736 backup.exe 612 backup.exe 612 backup.exe 612 backup.exe 612 backup.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 1616 data.exe 320 backup.exe 320 backup.exe 320 backup.exe 320 backup.exe 320 backup.exe 320 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe update.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe data.exe File opened for modification C:\Program Files\Internet Explorer\data.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe System Restore.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe data.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe data.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 952 backup.exe 1692 backup.exe 1512 update.exe 1980 backup.exe 1340 backup.exe 700 backup.exe 1380 backup.exe 868 backup.exe 972 backup.exe 1712 backup.exe 1064 data.exe 1528 backup.exe 1472 backup.exe 1736 backup.exe 612 backup.exe 108 backup.exe 1616 data.exe 1684 backup.exe 1676 backup.exe 1348 backup.exe 1048 backup.exe 436 backup.exe 596 backup.exe 1680 backup.exe 676 backup.exe 588 backup.exe 1148 backup.exe 1352 backup.exe 320 backup.exe 1720 backup.exe 1768 backup.exe 1924 backup.exe 1776 backup.exe 1828 backup.exe 1004 backup.exe 1524 backup.exe 1112 backup.exe 1868 backup.exe 1456 backup.exe 1700 backup.exe 584 backup.exe 996 backup.exe 824 backup.exe 1628 backup.exe 872 backup.exe 1284 backup.exe 1672 backup.exe 1588 backup.exe 1692 backup.exe 1592 backup.exe 1580 update.exe 556 backup.exe 768 backup.exe 700 backup.exe 1252 backup.exe 588 backup.exe 1068 backup.exe 1800 backup.exe 1324 backup.exe 580 backup.exe 268 backup.exe 784 backup.exe 1688 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 952 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 28 PID 1724 wrote to memory of 952 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 28 PID 1724 wrote to memory of 952 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 28 PID 1724 wrote to memory of 952 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 28 PID 1724 wrote to memory of 1692 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 29 PID 1724 wrote to memory of 1692 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 29 PID 1724 wrote to memory of 1692 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 29 PID 1724 wrote to memory of 1692 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 29 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1512 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 30 PID 1724 wrote to memory of 1980 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 31 PID 1724 wrote to memory of 1980 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 31 PID 1724 wrote to memory of 1980 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 31 PID 1724 wrote to memory of 1980 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 31 PID 1724 wrote to memory of 1340 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 32 PID 1724 wrote to memory of 1340 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 32 PID 1724 wrote to memory of 1340 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 32 PID 1724 wrote to memory of 1340 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 32 PID 1724 wrote to memory of 700 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 33 PID 1724 wrote to memory of 700 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 33 PID 1724 wrote to memory of 700 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 33 PID 1724 wrote to memory of 700 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 33 PID 1724 wrote to memory of 1380 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 34 PID 1724 wrote to memory of 1380 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 34 PID 1724 wrote to memory of 1380 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 34 PID 1724 wrote to memory of 1380 1724 ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe 34 PID 952 wrote to memory of 868 952 backup.exe 35 PID 952 wrote to memory of 868 952 backup.exe 35 PID 952 wrote to memory of 868 952 backup.exe 35 PID 952 wrote to memory of 868 952 backup.exe 35 PID 868 wrote to memory of 972 868 backup.exe 36 PID 868 wrote to memory of 972 868 backup.exe 36 PID 868 wrote to memory of 972 868 backup.exe 36 PID 868 wrote to memory of 972 868 backup.exe 36 PID 972 wrote to memory of 1712 972 backup.exe 37 PID 972 wrote to memory of 1712 972 backup.exe 37 PID 972 wrote to memory of 1712 972 backup.exe 37 PID 972 wrote to memory of 1712 972 backup.exe 37 PID 868 wrote to memory of 1064 868 backup.exe 38 PID 868 wrote to memory of 1064 868 backup.exe 38 PID 868 wrote to memory of 1064 868 backup.exe 38 PID 868 wrote to memory of 1064 868 backup.exe 38 PID 1064 wrote to memory of 1528 1064 data.exe 39 PID 1064 wrote to memory of 1528 1064 data.exe 39 PID 1064 wrote to memory of 1528 1064 data.exe 39 PID 1064 wrote to memory of 1528 1064 data.exe 39 PID 1528 wrote to memory of 1472 1528 backup.exe 40 PID 1528 wrote to memory of 1472 1528 backup.exe 40 PID 1528 wrote to memory of 1472 1528 backup.exe 40 PID 1528 wrote to memory of 1472 1528 backup.exe 40 PID 1064 wrote to memory of 1736 1064 data.exe 41 PID 1064 wrote to memory of 1736 1064 data.exe 41 PID 1064 wrote to memory of 1736 1064 data.exe 41 PID 1064 wrote to memory of 1736 1064 data.exe 41 PID 1736 wrote to memory of 612 1736 backup.exe 42 PID 1736 wrote to memory of 612 1736 backup.exe 42 PID 1736 wrote to memory of 612 1736 backup.exe 42 PID 1736 wrote to memory of 612 1736 backup.exe 42 PID 612 wrote to memory of 108 612 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe"C:\Users\Admin\AppData\Local\Temp\ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\485290244\backup.exeC:\Users\Admin\AppData\Local\Temp\485290244\backup.exe C:\Users\Admin\AppData\Local\Temp\485290244\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:972 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
-
C:\Program Files\data.exe"C:\Program Files\data.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1528 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:108
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1676
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1348
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:436
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:676
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1148
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:320 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1672
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1072
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
PID:776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Disables RegEdit via registry modification
PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵PID:580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:2172
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1284 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:768
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:1656
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:1844
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1980
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:804 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1068
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1124
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2088
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files\Common Files\SpeechEngines\update.exe"C:\Program Files\Common Files\SpeechEngines\update.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1068
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:784 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:968 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1604
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:1048
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1564
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1320
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- System policy modification
PID:692
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1620
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1348
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1412
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:972
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1284
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1476
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2156
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1588 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:556
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1252
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:320
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:284
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
PID:1684
-
-
C:\Program Files\DVD Maker\Shared\update.exe"C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Drops file in Program Files directory
PID:280 -
C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1384 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1944
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1712
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
PID:1296
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1084
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1556
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1620
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:1536
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:2188
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1524 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:776
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:772
-
-
-
-
C:\Program Files\Internet Explorer\data.exe"C:\Program Files\Internet Explorer\data.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:928 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:984
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:988
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:584
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1612
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2212
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1944
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:2108
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1560
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:968
-
-
C:\Program Files\Mozilla Firefox\update.exe"C:\Program Files\Mozilla Firefox\update.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2128
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:700 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:688 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:1972
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:1696
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1124
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1536 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1768
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:1776
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
PID:1112 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1240
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1812
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1252
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:560
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1736
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2052
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1844 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1768
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2040
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1712
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:2068
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2204
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1756
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1336 -
C:\Program Files (x86)\Common Files\Adobe\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:472 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1784
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:304
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:2120
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1656
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1812
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2096
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1548
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:524
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2196
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1700
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:572
-
C:\Users\Admin\Contacts\data.exeC:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\6⤵PID:1172
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:2164
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1212
-
C:\Users\Public\Documents\data.exeC:\Users\Public\Documents\data.exe C:\Users\Public\Documents\6⤵PID:1776
-
-
C:\Users\Public\Downloads\data.exeC:\Users\Public\Downloads\data.exe C:\Users\Public\Downloads\6⤵PID:2148
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:276 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1516
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:2004
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1328
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2180
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\Low\update.exeC:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:700
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1380
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD52955fa58c0f9b8f743bede4df9785d08
SHA1c2393d547255449a0596022e94811bd6eca143e6
SHA25610e1c417dfa365c61a3fd0c8031ce633dbc7d1e56af3d9d515a24e7abbc81b36
SHA512113b6d205b4f753c77cfce882211554ec8fc4b2435c0ec28cc8c4a26b94b812a9f94a2470e92c1a15bf963084d5208e1c8e6781da55a20c02921ae7b3771f4ff
-
Filesize
72KB
MD5707a61cf2ed77e9f65caaf67155bf6cb
SHA12960c8c96a7a83d83aaf149d91d043f1fa3f3d23
SHA256ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6
SHA512472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc
-
Filesize
72KB
MD5707a61cf2ed77e9f65caaf67155bf6cb
SHA12960c8c96a7a83d83aaf149d91d043f1fa3f3d23
SHA256ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6
SHA512472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc
-
Filesize
72KB
MD5ce499c73d771a9ab0876658b34ad60c3
SHA1011da82531eab338f3155da219f3cc110fc5ac7d
SHA2563320f93de0a05b3c7b37a4b1aef312af4c03ced24c7fa8e5b22b8d51c838b7c0
SHA5129345a0f39b359f05d2ebdc7956e7a1e7f274f7e63fc8e683a8210548d557897fa0cec60eb9c4935fa84c05d9f6e825f5880bbdec6489ecfc0b9d326de8c12537
-
Filesize
72KB
MD51b6f46fc093a2e08b642464d1c732102
SHA17f181a8b349d7ce24d84da17feab867d76abbc26
SHA256bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92
SHA512f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef
-
Filesize
72KB
MD51b6f46fc093a2e08b642464d1c732102
SHA17f181a8b349d7ce24d84da17feab867d76abbc26
SHA256bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92
SHA512f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD5cb57fa41e031000b16a5b2bf6e86fe51
SHA18967e5957e323818d849390c94d14a1ef883aa33
SHA256a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13
SHA512b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12
-
Filesize
72KB
MD5cb57fa41e031000b16a5b2bf6e86fe51
SHA18967e5957e323818d849390c94d14a1ef883aa33
SHA256a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13
SHA512b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12
-
Filesize
72KB
MD5ea9999892d76fa5ec2c8a0e77d244ba2
SHA17a68f34277b5e37d7c6d79561c9ee0f9f7b71c31
SHA2560c3111ee249a5ae4e51db9aa1b00ded8e22a730447ff7c43aaf2720801e240e0
SHA51224ee60f5dd4bd3ac864f9fd4925ff7c3853a4f0367f8fe17ba868a0a7a0f5d4574ad783855675461927c45c12fe14c5e186afc920e9fff20bc2367fdf2e46471
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD50028bbfcf7e8c7f992161a365a214dcf
SHA1f7605cb3394fc71c1c2ecceb6ff676649a9b37a7
SHA2560c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1
SHA512527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf
-
Filesize
72KB
MD50028bbfcf7e8c7f992161a365a214dcf
SHA1f7605cb3394fc71c1c2ecceb6ff676649a9b37a7
SHA2560c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1
SHA512527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf
-
Filesize
72KB
MD573fa53182e7ee0e965931b37651caf74
SHA1c781dbb44f634bce39344c984f9b60f6d400ac55
SHA25653e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997
SHA51280191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a
-
Filesize
72KB
MD573fa53182e7ee0e965931b37651caf74
SHA1c781dbb44f634bce39344c984f9b60f6d400ac55
SHA25653e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997
SHA51280191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a
-
Filesize
72KB
MD5768588b970e015c7b1d2b3b30bddda3a
SHA1a1910572efe948d136eed5fc6cefbdcf158fc0ea
SHA256ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6
SHA51271f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37
-
Filesize
72KB
MD5768588b970e015c7b1d2b3b30bddda3a
SHA1a1910572efe948d136eed5fc6cefbdcf158fc0ea
SHA256ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6
SHA51271f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5d1ef689557d681b6aa855509204a568d
SHA1a9c9190f19b912390e43bf8274ac50874504e69c
SHA25670bfe9f16b7600afe2bc4a90cd147b777a19b1d874510f730dfbc74f3d5991ac
SHA5121745552b9125135a738daa56bf1211f562a42356bebecf0078e0facaf466ea251401ec23e50540a8e3c6f600695cbaa79510e524aa3df733ceabee970b25939c
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e01b4c688d0aece3fa4912ad7bca7158
SHA127e8b5f29c4260b0f937c345281497d77bbe37db
SHA256fc0f8bd2856c5b30a8ccf0e861101a27c27a9fcf8dbb130dc1462b207e74974e
SHA512825c6aa95d60f9b66dc5cbcc1f0e7433d205e0de767b01acea365879b3f46efbda85efe666c083b155b89dfbadf4786b6b1cfc32d18255120aaf3690a2e88665
-
Filesize
72KB
MD5e01b4c688d0aece3fa4912ad7bca7158
SHA127e8b5f29c4260b0f937c345281497d77bbe37db
SHA256fc0f8bd2856c5b30a8ccf0e861101a27c27a9fcf8dbb130dc1462b207e74974e
SHA512825c6aa95d60f9b66dc5cbcc1f0e7433d205e0de767b01acea365879b3f46efbda85efe666c083b155b89dfbadf4786b6b1cfc32d18255120aaf3690a2e88665
-
Filesize
72KB
MD52955fa58c0f9b8f743bede4df9785d08
SHA1c2393d547255449a0596022e94811bd6eca143e6
SHA25610e1c417dfa365c61a3fd0c8031ce633dbc7d1e56af3d9d515a24e7abbc81b36
SHA512113b6d205b4f753c77cfce882211554ec8fc4b2435c0ec28cc8c4a26b94b812a9f94a2470e92c1a15bf963084d5208e1c8e6781da55a20c02921ae7b3771f4ff
-
Filesize
72KB
MD52955fa58c0f9b8f743bede4df9785d08
SHA1c2393d547255449a0596022e94811bd6eca143e6
SHA25610e1c417dfa365c61a3fd0c8031ce633dbc7d1e56af3d9d515a24e7abbc81b36
SHA512113b6d205b4f753c77cfce882211554ec8fc4b2435c0ec28cc8c4a26b94b812a9f94a2470e92c1a15bf963084d5208e1c8e6781da55a20c02921ae7b3771f4ff
-
Filesize
72KB
MD5707a61cf2ed77e9f65caaf67155bf6cb
SHA12960c8c96a7a83d83aaf149d91d043f1fa3f3d23
SHA256ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6
SHA512472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc
-
Filesize
72KB
MD5707a61cf2ed77e9f65caaf67155bf6cb
SHA12960c8c96a7a83d83aaf149d91d043f1fa3f3d23
SHA256ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6
SHA512472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc
-
Filesize
72KB
MD5ce499c73d771a9ab0876658b34ad60c3
SHA1011da82531eab338f3155da219f3cc110fc5ac7d
SHA2563320f93de0a05b3c7b37a4b1aef312af4c03ced24c7fa8e5b22b8d51c838b7c0
SHA5129345a0f39b359f05d2ebdc7956e7a1e7f274f7e63fc8e683a8210548d557897fa0cec60eb9c4935fa84c05d9f6e825f5880bbdec6489ecfc0b9d326de8c12537
-
Filesize
72KB
MD5ce499c73d771a9ab0876658b34ad60c3
SHA1011da82531eab338f3155da219f3cc110fc5ac7d
SHA2563320f93de0a05b3c7b37a4b1aef312af4c03ced24c7fa8e5b22b8d51c838b7c0
SHA5129345a0f39b359f05d2ebdc7956e7a1e7f274f7e63fc8e683a8210548d557897fa0cec60eb9c4935fa84c05d9f6e825f5880bbdec6489ecfc0b9d326de8c12537
-
Filesize
72KB
MD51b6f46fc093a2e08b642464d1c732102
SHA17f181a8b349d7ce24d84da17feab867d76abbc26
SHA256bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92
SHA512f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef
-
Filesize
72KB
MD51b6f46fc093a2e08b642464d1c732102
SHA17f181a8b349d7ce24d84da17feab867d76abbc26
SHA256bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92
SHA512f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD5cb57fa41e031000b16a5b2bf6e86fe51
SHA18967e5957e323818d849390c94d14a1ef883aa33
SHA256a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13
SHA512b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12
-
Filesize
72KB
MD5cb57fa41e031000b16a5b2bf6e86fe51
SHA18967e5957e323818d849390c94d14a1ef883aa33
SHA256a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13
SHA512b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12
-
Filesize
72KB
MD5ea9999892d76fa5ec2c8a0e77d244ba2
SHA17a68f34277b5e37d7c6d79561c9ee0f9f7b71c31
SHA2560c3111ee249a5ae4e51db9aa1b00ded8e22a730447ff7c43aaf2720801e240e0
SHA51224ee60f5dd4bd3ac864f9fd4925ff7c3853a4f0367f8fe17ba868a0a7a0f5d4574ad783855675461927c45c12fe14c5e186afc920e9fff20bc2367fdf2e46471
-
Filesize
72KB
MD5ea9999892d76fa5ec2c8a0e77d244ba2
SHA17a68f34277b5e37d7c6d79561c9ee0f9f7b71c31
SHA2560c3111ee249a5ae4e51db9aa1b00ded8e22a730447ff7c43aaf2720801e240e0
SHA51224ee60f5dd4bd3ac864f9fd4925ff7c3853a4f0367f8fe17ba868a0a7a0f5d4574ad783855675461927c45c12fe14c5e186afc920e9fff20bc2367fdf2e46471
-
Filesize
72KB
MD531d6344cb7284902138ddc2311af631f
SHA127cc12938b567f9016f63722bbf6cbd323b79dcb
SHA256f7f954254bf29f478513684671306be1a0dda89aafc20cd04f50ee3ab10f99f3
SHA51220a02ebc167d0f607a3b5aefbdf93aff1ea4be4ef97f1710d72c5eb6459325c00e33d87d2460ebe156f48fc375650ee2f5bc31b2951684134c2162f92ec198c7
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD5b9dd7fe1d07c3d7f310e9311b55c6e7e
SHA1d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12
SHA256df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd
SHA512ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6
-
Filesize
72KB
MD50028bbfcf7e8c7f992161a365a214dcf
SHA1f7605cb3394fc71c1c2ecceb6ff676649a9b37a7
SHA2560c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1
SHA512527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf
-
Filesize
72KB
MD50028bbfcf7e8c7f992161a365a214dcf
SHA1f7605cb3394fc71c1c2ecceb6ff676649a9b37a7
SHA2560c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1
SHA512527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf
-
Filesize
72KB
MD573fa53182e7ee0e965931b37651caf74
SHA1c781dbb44f634bce39344c984f9b60f6d400ac55
SHA25653e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997
SHA51280191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a
-
Filesize
72KB
MD573fa53182e7ee0e965931b37651caf74
SHA1c781dbb44f634bce39344c984f9b60f6d400ac55
SHA25653e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997
SHA51280191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a
-
Filesize
72KB
MD5768588b970e015c7b1d2b3b30bddda3a
SHA1a1910572efe948d136eed5fc6cefbdcf158fc0ea
SHA256ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6
SHA51271f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37
-
Filesize
72KB
MD5768588b970e015c7b1d2b3b30bddda3a
SHA1a1910572efe948d136eed5fc6cefbdcf158fc0ea
SHA256ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6
SHA51271f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5d1ef689557d681b6aa855509204a568d
SHA1a9c9190f19b912390e43bf8274ac50874504e69c
SHA25670bfe9f16b7600afe2bc4a90cd147b777a19b1d874510f730dfbc74f3d5991ac
SHA5121745552b9125135a738daa56bf1211f562a42356bebecf0078e0facaf466ea251401ec23e50540a8e3c6f600695cbaa79510e524aa3df733ceabee970b25939c
-
Filesize
72KB
MD5d1ef689557d681b6aa855509204a568d
SHA1a9c9190f19b912390e43bf8274ac50874504e69c
SHA25670bfe9f16b7600afe2bc4a90cd147b777a19b1d874510f730dfbc74f3d5991ac
SHA5121745552b9125135a738daa56bf1211f562a42356bebecf0078e0facaf466ea251401ec23e50540a8e3c6f600695cbaa79510e524aa3df733ceabee970b25939c
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8
-
Filesize
72KB
MD5e7654f4a2452beff6deb573954636703
SHA1b22726e9e2d9c6710945216fd334960464c60c6a
SHA256a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653
SHA512adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8