Analysis
-
max time kernel
128s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:39
Static task
static1
Behavioral task
behavioral1
Sample
7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe
Resource
win10v2004-20220812-en
General
-
Target
7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe
-
Size
72KB
-
MD5
009b50173931a42e43ef40bb34477026
-
SHA1
6817fd238d171b32b172e7bbf8908a99cfcba2df
-
SHA256
7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d
-
SHA512
a66ce1274cea06d9d64d9597e5c2e3b78b50a9e99a25d4fe1c3b603ff4ff9a9081576794abdf4759c84a059b1a06cc1056ed92506d967a2192db3fbc3517aedb
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2b:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1916 backup.exe 112 backup.exe 1324 backup.exe 1740 backup.exe 1656 data.exe 1060 backup.exe 844 backup.exe 968 backup.exe 1188 backup.exe 1964 update.exe 1956 update.exe 1344 backup.exe 808 backup.exe 568 backup.exe 1120 backup.exe 1700 backup.exe 1996 backup.exe 1596 backup.exe 1752 backup.exe 936 backup.exe 2032 backup.exe 2020 backup.exe 1968 backup.exe 1892 backup.exe 1772 backup.exe 2000 backup.exe 1112 backup.exe 1332 backup.exe 968 data.exe 1444 backup.exe 1932 backup.exe 1528 backup.exe 1912 backup.exe 332 backup.exe 1800 backup.exe 1828 backup.exe 1736 backup.exe 952 System Restore.exe 1056 backup.exe 964 backup.exe 912 backup.exe 1468 update.exe 1984 backup.exe 1456 backup.exe 1952 backup.exe 1700 backup.exe 1956 backup.exe 2028 backup.exe 1988 backup.exe 2032 backup.exe 1740 backup.exe 812 backup.exe 1768 data.exe 1492 backup.exe 1352 backup.exe 1460 backup.exe 968 backup.exe 1164 backup.exe 1836 backup.exe 1376 backup.exe 1672 backup.exe 572 backup.exe 332 backup.exe 1192 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1060 backup.exe 1060 backup.exe 844 backup.exe 844 backup.exe 1060 backup.exe 1060 backup.exe 1188 backup.exe 1956 update.exe 1188 backup.exe 1956 update.exe 1964 update.exe 1964 update.exe 1964 update.exe 1956 update.exe 1188 backup.exe 1060 backup.exe 1060 backup.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1344 backup.exe 1344 backup.exe 1956 update.exe 1956 update.exe 1700 backup.exe 1700 backup.exe 1700 backup.exe 1120 backup.exe 1120 backup.exe 808 backup.exe 808 backup.exe 1120 backup.exe 1596 backup.exe 1120 backup.exe 1596 backup.exe 936 backup.exe 1752 backup.exe 936 backup.exe 1752 backup.exe 936 backup.exe 936 backup.exe 1752 backup.exe 1752 backup.exe 936 backup.exe 936 backup.exe 1892 backup.exe 1892 backup.exe 936 backup.exe 936 backup.exe 1892 backup.exe 936 backup.exe 1892 backup.exe 936 backup.exe 936 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\System Restore.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\data.exe update.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\update.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 1916 backup.exe 112 backup.exe 1324 backup.exe 1740 backup.exe 1656 data.exe 1060 backup.exe 844 backup.exe 968 backup.exe 1188 backup.exe 1956 update.exe 1964 update.exe 1344 backup.exe 808 backup.exe 568 backup.exe 1120 backup.exe 1700 backup.exe 1996 backup.exe 1596 backup.exe 1752 backup.exe 936 backup.exe 2032 backup.exe 2020 backup.exe 1968 backup.exe 1892 backup.exe 1772 backup.exe 2000 backup.exe 1112 backup.exe 968 data.exe 1332 backup.exe 1444 backup.exe 1932 backup.exe 1912 backup.exe 1528 backup.exe 332 backup.exe 1800 backup.exe 1828 backup.exe 1736 backup.exe 952 System Restore.exe 1056 backup.exe 964 backup.exe 912 backup.exe 1984 backup.exe 1468 update.exe 1952 backup.exe 1456 backup.exe 1956 backup.exe 1700 backup.exe 2028 backup.exe 1988 backup.exe 2032 backup.exe 1740 backup.exe 812 backup.exe 1768 data.exe 1492 backup.exe 1352 backup.exe 1460 backup.exe 968 backup.exe 1164 backup.exe 1836 backup.exe 1376 backup.exe 1672 backup.exe 572 backup.exe 332 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1916 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 27 PID 1152 wrote to memory of 1916 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 27 PID 1152 wrote to memory of 1916 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 27 PID 1152 wrote to memory of 1916 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 27 PID 1152 wrote to memory of 112 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 28 PID 1152 wrote to memory of 112 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 28 PID 1152 wrote to memory of 112 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 28 PID 1152 wrote to memory of 112 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 28 PID 1152 wrote to memory of 1324 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 29 PID 1152 wrote to memory of 1324 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 29 PID 1152 wrote to memory of 1324 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 29 PID 1152 wrote to memory of 1324 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 29 PID 1152 wrote to memory of 1740 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 30 PID 1152 wrote to memory of 1740 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 30 PID 1152 wrote to memory of 1740 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 30 PID 1152 wrote to memory of 1740 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 30 PID 1152 wrote to memory of 1656 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 31 PID 1152 wrote to memory of 1656 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 31 PID 1152 wrote to memory of 1656 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 31 PID 1152 wrote to memory of 1656 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 31 PID 1916 wrote to memory of 1060 1916 backup.exe 32 PID 1916 wrote to memory of 1060 1916 backup.exe 32 PID 1916 wrote to memory of 1060 1916 backup.exe 32 PID 1916 wrote to memory of 1060 1916 backup.exe 32 PID 1060 wrote to memory of 844 1060 backup.exe 34 PID 1060 wrote to memory of 844 1060 backup.exe 34 PID 1060 wrote to memory of 844 1060 backup.exe 34 PID 1060 wrote to memory of 844 1060 backup.exe 34 PID 844 wrote to memory of 968 844 backup.exe 35 PID 844 wrote to memory of 968 844 backup.exe 35 PID 844 wrote to memory of 968 844 backup.exe 35 PID 844 wrote to memory of 968 844 backup.exe 35 PID 1060 wrote to memory of 1188 1060 backup.exe 36 PID 1060 wrote to memory of 1188 1060 backup.exe 36 PID 1060 wrote to memory of 1188 1060 backup.exe 36 PID 1060 wrote to memory of 1188 1060 backup.exe 36 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1152 wrote to memory of 1964 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 33 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1956 1188 backup.exe 37 PID 1188 wrote to memory of 1344 1188 backup.exe 38 PID 1188 wrote to memory of 1344 1188 backup.exe 38 PID 1188 wrote to memory of 1344 1188 backup.exe 38 PID 1188 wrote to memory of 1344 1188 backup.exe 38 PID 1060 wrote to memory of 808 1060 backup.exe 39 PID 1060 wrote to memory of 808 1060 backup.exe 39 PID 1060 wrote to memory of 808 1060 backup.exe 39 PID 1060 wrote to memory of 808 1060 backup.exe 39 PID 1152 wrote to memory of 568 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 40 PID 1152 wrote to memory of 568 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 40 PID 1152 wrote to memory of 568 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 40 PID 1152 wrote to memory of 568 1152 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe 40 PID 1344 wrote to memory of 1120 1344 backup.exe 41 PID 1344 wrote to memory of 1120 1344 backup.exe 41 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe"C:\Users\Admin\AppData\Local\Temp\7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\1912821174\backup.exeC:\Users\Admin\AppData\Local\Temp\1912821174\backup.exe C:\Users\Admin\AppData\Local\Temp\1912821174\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1916 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1060 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Program Files\7-Zip\update.exe"C:\Program Files\7-Zip\update.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1120 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:936 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1984 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1376
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1192
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
PID:364
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Disables RegEdit via registry modification
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Disables RegEdit via registry modification
PID:472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵PID:1364
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Disables RegEdit via registry modification
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:1044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
PID:2020
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1980 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- System policy modification
PID:812
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
PID:608
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1748
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1964 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1612
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1164
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\data.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\data.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:812
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1348
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:652
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1072
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- System policy modification
PID:2040
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Disables RegEdit via registry modification
PID:844 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:876
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1380
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:2068
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:2016
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:944
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1648
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:2008 -
C:\Program Files\DVD Maker\de-DE\System Restore.exe"C:\Program Files\DVD Maker\de-DE\System Restore.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- System policy modification
PID:548
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2024
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- System policy modification
PID:2020
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1536
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1192
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1800
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1116
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- System policy modification
PID:964 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1772 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1444 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:676
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1712
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1112
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1328
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1936
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:548
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:808 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1596 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1752 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1332
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:332
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1056 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:912
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1700 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1352
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:968 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:332
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1736 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
PID:1760
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- Modifies visibility of file extensions in Explorer
PID:756
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1620 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1168
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1604
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
PID:1116
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Disables RegEdit via registry modification
PID:1108 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- Modifies visibility of file extensions in Explorer
PID:1980
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2032 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- Drops file in Program Files directory
- System policy modification
PID:812 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵
- Disables RegEdit via registry modification
PID:1704
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1352
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1320 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1924 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\10⤵PID:1908
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1572 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:332
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵
- Modifies visibility of file extensions in Explorer
PID:1952
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\11⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:952
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1040 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:1552
-
-
-
-
-
C:\Program Files (x86)\Common Files\update.exe"C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1840 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
PID:1744 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1992
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Drops file in Program Files directory
PID:1940 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1776 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Disables RegEdit via registry modification
PID:1704 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵PID:1948
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- Disables RegEdit via registry modification
PID:1164
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\data.exe"C:\Program Files (x86)\Common Files\Adobe AIR\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1328 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- System policy modification
PID:1468 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵
- Disables RegEdit via registry modification
PID:1732
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- System policy modification
PID:284
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1920 -
C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1588
-
-
C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\7⤵PID:664
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\7⤵PID:1700
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EURO\data.exe"C:\Program Files (x86)\Common Files\microsoft shared\EURO\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\7⤵PID:332
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\7⤵PID:188
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1972
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:1676
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2092
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
PID:1736 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- System policy modification
PID:1708
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1656
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1752
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1956
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:984
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2084
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1820
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- System policy modification
PID:456 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1356
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:2012
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1968
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:848
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1768
-
-
C:\Users\Admin\Links\data.exeC:\Users\Admin\Links\data.exe C:\Users\Admin\Links\6⤵PID:1772
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2052
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1760 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Modifies visibility of file extensions in Explorer
PID:1044
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1704
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:1896
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:2024
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵PID:1836
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵PID:2060
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:952 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:1016
-
-
C:\Windows\AppCompat\update.exeC:\Windows\AppCompat\update.exe C:\Windows\AppCompat\5⤵
- Disables RegEdit via registry modification
PID:1960
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1944
-
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\6⤵PID:1748
-
-
C:\Windows\AppPatch\Custom\backup.exeC:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\6⤵PID:1832
-
-
C:\Windows\AppPatch\de-DE\backup.exeC:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\6⤵PID:1952
-
-
C:\Windows\AppPatch\en-US\backup.exeC:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\6⤵PID:1720
-
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2020
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2000
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:2076
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:112
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:568
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c80d1304f02586e907019662871209f8
SHA1dd5467b2f91a8f228adbea7648d06216b6c84a35
SHA2569f541c512f393b139ffe1cb13b3ce3c153c8745ff8605fead41a08df85aed8e5
SHA512981da3a5e756c430d23f1ce1cacb54cc792308405acbe6623bdaecc8e24b6eff237d16a018fa433c88753cb5e8f0452caaef68d94f979cbaf5beaef09611b440
-
Filesize
72KB
MD544f0dfa6cff998f910d15a379f15583f
SHA12989c0f51626173f9089cd56e69679efe3b3a86c
SHA25613b65b0495f22ba450f8cc99378c18499c1ff0f192a9049b91b894bad831a346
SHA5120cadab2e7264101ff05330b6e5f79bb18a1cc88d19eba426812eea5c1378e841f7fd6b37411f03643eedd3761764c253ddaa23c36193390e4b42d56724ab2723
-
Filesize
72KB
MD544f0dfa6cff998f910d15a379f15583f
SHA12989c0f51626173f9089cd56e69679efe3b3a86c
SHA25613b65b0495f22ba450f8cc99378c18499c1ff0f192a9049b91b894bad831a346
SHA5120cadab2e7264101ff05330b6e5f79bb18a1cc88d19eba426812eea5c1378e841f7fd6b37411f03643eedd3761764c253ddaa23c36193390e4b42d56724ab2723
-
Filesize
72KB
MD525373b77c1c637ff3edacea97d38dbcf
SHA1d09f5591e4c3d8a8131c2f4c694214833754b04c
SHA256cecc7e2011fdb4286481f9a5009f6a543bcada58eb2ed1298cf1f4ae679302dc
SHA5123e4379468d59b53a7e1cf07ef4d2dc080c0c52d659431e714d44411da6405b65be5bc849655ed87c047f542a20aedb4e4c5049337c2b16763b42d944f2335f35
-
Filesize
72KB
MD525373b77c1c637ff3edacea97d38dbcf
SHA1d09f5591e4c3d8a8131c2f4c694214833754b04c
SHA256cecc7e2011fdb4286481f9a5009f6a543bcada58eb2ed1298cf1f4ae679302dc
SHA5123e4379468d59b53a7e1cf07ef4d2dc080c0c52d659431e714d44411da6405b65be5bc849655ed87c047f542a20aedb4e4c5049337c2b16763b42d944f2335f35
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5f7c7bdc7770045d0612263a468702f20
SHA1a4c10b4d310d144afc5aba7c59e9f6b41a772d3a
SHA2569146cf93cc96efd6c785955b2faf7b1dfc0426661eda3a21761a26ee70c5223a
SHA512d4978e985ae99795ca63595b7abbef2a1a9be36dea554c32a2958015d6e05fbd414a4a1b9a23627d516194f859179ff345272534502d3a2467c12a02094cb2fa
-
Filesize
72KB
MD5f7c7bdc7770045d0612263a468702f20
SHA1a4c10b4d310d144afc5aba7c59e9f6b41a772d3a
SHA2569146cf93cc96efd6c785955b2faf7b1dfc0426661eda3a21761a26ee70c5223a
SHA512d4978e985ae99795ca63595b7abbef2a1a9be36dea554c32a2958015d6e05fbd414a4a1b9a23627d516194f859179ff345272534502d3a2467c12a02094cb2fa
-
Filesize
72KB
MD5e3af8dea90e6b317bafc65fe8be9dbe6
SHA181d9896ea4efef5934dcb7ffea9e71232f77bbab
SHA256d76dbb9030aca1ef247efb79dccc4d0986201d4c7cc76edfcb86eebbc31f42a3
SHA512cb62c0134a07e49b40b358dc433165be554ceb27b5a0d2e73c3cae7a0443180ef804f50572307737bda1a1b3bc222e53d2cc735840d0ada841e840595df05728
-
Filesize
72KB
MD5e3af8dea90e6b317bafc65fe8be9dbe6
SHA181d9896ea4efef5934dcb7ffea9e71232f77bbab
SHA256d76dbb9030aca1ef247efb79dccc4d0986201d4c7cc76edfcb86eebbc31f42a3
SHA512cb62c0134a07e49b40b358dc433165be554ceb27b5a0d2e73c3cae7a0443180ef804f50572307737bda1a1b3bc222e53d2cc735840d0ada841e840595df05728
-
Filesize
72KB
MD5dcabd0d81699dbeb8224ba26f6b2cd14
SHA18783a4982d92ed03751d18fbbd40345c4b1d5cbd
SHA25672089e2411349d2fa6e41d4daa449912d370774430d2d6de3641895ee531c160
SHA51269a6a1ca80cce19528f1c3951d6a265c4ee02a45bc34a420d8d2f07aedf0e6336a2390be16e3e3673478572dbbd8c627b98e731ea61f49a829428026375e253a
-
Filesize
72KB
MD5dcabd0d81699dbeb8224ba26f6b2cd14
SHA18783a4982d92ed03751d18fbbd40345c4b1d5cbd
SHA25672089e2411349d2fa6e41d4daa449912d370774430d2d6de3641895ee531c160
SHA51269a6a1ca80cce19528f1c3951d6a265c4ee02a45bc34a420d8d2f07aedf0e6336a2390be16e3e3673478572dbbd8c627b98e731ea61f49a829428026375e253a
-
Filesize
72KB
MD5b998749e9867aa08752856c68a59c3ab
SHA1ff2ddf362c053e8f9f7b3cca42a0520846e09ab6
SHA2566fbe900562533f3f6abaf56c75a73ab51973fb37f19bbdbccb16660ff016cfe8
SHA5121dad952071789925a5a76f7b42b4d6da81a96327f1c15e37d98ca235f31739f11c167a9dc6237b9cfe6d5e42ef6454746de551ff09a492df35b5a16ed8117e8c
-
Filesize
72KB
MD5b998749e9867aa08752856c68a59c3ab
SHA1ff2ddf362c053e8f9f7b3cca42a0520846e09ab6
SHA2566fbe900562533f3f6abaf56c75a73ab51973fb37f19bbdbccb16660ff016cfe8
SHA5121dad952071789925a5a76f7b42b4d6da81a96327f1c15e37d98ca235f31739f11c167a9dc6237b9cfe6d5e42ef6454746de551ff09a492df35b5a16ed8117e8c
-
Filesize
72KB
MD549493567756712ca6d2e16732ba6b03d
SHA1b62a0acef09121e8c0b60d80d1b1c1d30f7634c9
SHA2564045d78f2d32c7d6cca943435a9e87456bcc35cd11719f182764c87ca3ef99e1
SHA512c5a07e6c502d364a2241ac80f2a3dac55faf39ea8c31919b9663a7ca2a7dbfa9e0f4e03ce3aad76763b8be88ddb6e30ea2a3a8f2d6cdd45267532067fac4ac5b
-
Filesize
72KB
MD549493567756712ca6d2e16732ba6b03d
SHA1b62a0acef09121e8c0b60d80d1b1c1d30f7634c9
SHA2564045d78f2d32c7d6cca943435a9e87456bcc35cd11719f182764c87ca3ef99e1
SHA512c5a07e6c502d364a2241ac80f2a3dac55faf39ea8c31919b9663a7ca2a7dbfa9e0f4e03ce3aad76763b8be88ddb6e30ea2a3a8f2d6cdd45267532067fac4ac5b
-
Filesize
72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
Filesize72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD593b9ee584f6134bfd99e21814b44ff96
SHA19429c096c8cb613c74d2d6bf2a6f6998e5a116d2
SHA256296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296
SHA51214499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3
-
Filesize
72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
Filesize
72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD5039b6afeb003158a9e47b514dd0a0169
SHA123806a9a893dd4cf4273752b14a38301e0229bf0
SHA25632e42b8cf93d01622275799143207841c923fbbba1cdd3e394bf4b54938d1168
SHA51219f6b566e0a4dea48a15c2c854f6f3c55ff5d5349820bce5bdc0ab534b4040da4d1a205d6d74292e194865a45380b12f416cbe9b37924b62a39d1c1cb349b7b0
-
Filesize
72KB
MD5039b6afeb003158a9e47b514dd0a0169
SHA123806a9a893dd4cf4273752b14a38301e0229bf0
SHA25632e42b8cf93d01622275799143207841c923fbbba1cdd3e394bf4b54938d1168
SHA51219f6b566e0a4dea48a15c2c854f6f3c55ff5d5349820bce5bdc0ab534b4040da4d1a205d6d74292e194865a45380b12f416cbe9b37924b62a39d1c1cb349b7b0
-
Filesize
72KB
MD5c80d1304f02586e907019662871209f8
SHA1dd5467b2f91a8f228adbea7648d06216b6c84a35
SHA2569f541c512f393b139ffe1cb13b3ce3c153c8745ff8605fead41a08df85aed8e5
SHA512981da3a5e756c430d23f1ce1cacb54cc792308405acbe6623bdaecc8e24b6eff237d16a018fa433c88753cb5e8f0452caaef68d94f979cbaf5beaef09611b440
-
Filesize
72KB
MD5c80d1304f02586e907019662871209f8
SHA1dd5467b2f91a8f228adbea7648d06216b6c84a35
SHA2569f541c512f393b139ffe1cb13b3ce3c153c8745ff8605fead41a08df85aed8e5
SHA512981da3a5e756c430d23f1ce1cacb54cc792308405acbe6623bdaecc8e24b6eff237d16a018fa433c88753cb5e8f0452caaef68d94f979cbaf5beaef09611b440
-
Filesize
72KB
MD544f0dfa6cff998f910d15a379f15583f
SHA12989c0f51626173f9089cd56e69679efe3b3a86c
SHA25613b65b0495f22ba450f8cc99378c18499c1ff0f192a9049b91b894bad831a346
SHA5120cadab2e7264101ff05330b6e5f79bb18a1cc88d19eba426812eea5c1378e841f7fd6b37411f03643eedd3761764c253ddaa23c36193390e4b42d56724ab2723
-
Filesize
72KB
MD544f0dfa6cff998f910d15a379f15583f
SHA12989c0f51626173f9089cd56e69679efe3b3a86c
SHA25613b65b0495f22ba450f8cc99378c18499c1ff0f192a9049b91b894bad831a346
SHA5120cadab2e7264101ff05330b6e5f79bb18a1cc88d19eba426812eea5c1378e841f7fd6b37411f03643eedd3761764c253ddaa23c36193390e4b42d56724ab2723
-
Filesize
72KB
MD525373b77c1c637ff3edacea97d38dbcf
SHA1d09f5591e4c3d8a8131c2f4c694214833754b04c
SHA256cecc7e2011fdb4286481f9a5009f6a543bcada58eb2ed1298cf1f4ae679302dc
SHA5123e4379468d59b53a7e1cf07ef4d2dc080c0c52d659431e714d44411da6405b65be5bc849655ed87c047f542a20aedb4e4c5049337c2b16763b42d944f2335f35
-
Filesize
72KB
MD525373b77c1c637ff3edacea97d38dbcf
SHA1d09f5591e4c3d8a8131c2f4c694214833754b04c
SHA256cecc7e2011fdb4286481f9a5009f6a543bcada58eb2ed1298cf1f4ae679302dc
SHA5123e4379468d59b53a7e1cf07ef4d2dc080c0c52d659431e714d44411da6405b65be5bc849655ed87c047f542a20aedb4e4c5049337c2b16763b42d944f2335f35
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5b3f2a92986da7275d75719d3d4ed9203
SHA1e7597de7dd2c206f33a3d29b823244f8e43f24e6
SHA25670220e79b51294d81895e47f77d20e835c129d67c62bd1360ed7acc7c8948abc
SHA512dc358ff0287b26f7049cea6ed10600588c63bccc4340d22a1d19bff4c943ae6bf43b9d9d4932acdc1c4bb3da10fddc687f594ca765ae6f5de7fb859fb16092c1
-
Filesize
72KB
MD5f7c7bdc7770045d0612263a468702f20
SHA1a4c10b4d310d144afc5aba7c59e9f6b41a772d3a
SHA2569146cf93cc96efd6c785955b2faf7b1dfc0426661eda3a21761a26ee70c5223a
SHA512d4978e985ae99795ca63595b7abbef2a1a9be36dea554c32a2958015d6e05fbd414a4a1b9a23627d516194f859179ff345272534502d3a2467c12a02094cb2fa
-
Filesize
72KB
MD5f7c7bdc7770045d0612263a468702f20
SHA1a4c10b4d310d144afc5aba7c59e9f6b41a772d3a
SHA2569146cf93cc96efd6c785955b2faf7b1dfc0426661eda3a21761a26ee70c5223a
SHA512d4978e985ae99795ca63595b7abbef2a1a9be36dea554c32a2958015d6e05fbd414a4a1b9a23627d516194f859179ff345272534502d3a2467c12a02094cb2fa
-
Filesize
72KB
MD5f7c7bdc7770045d0612263a468702f20
SHA1a4c10b4d310d144afc5aba7c59e9f6b41a772d3a
SHA2569146cf93cc96efd6c785955b2faf7b1dfc0426661eda3a21761a26ee70c5223a
SHA512d4978e985ae99795ca63595b7abbef2a1a9be36dea554c32a2958015d6e05fbd414a4a1b9a23627d516194f859179ff345272534502d3a2467c12a02094cb2fa
-
Filesize
72KB
MD5f7c7bdc7770045d0612263a468702f20
SHA1a4c10b4d310d144afc5aba7c59e9f6b41a772d3a
SHA2569146cf93cc96efd6c785955b2faf7b1dfc0426661eda3a21761a26ee70c5223a
SHA512d4978e985ae99795ca63595b7abbef2a1a9be36dea554c32a2958015d6e05fbd414a4a1b9a23627d516194f859179ff345272534502d3a2467c12a02094cb2fa
-
Filesize
72KB
MD50f5c29e6d2722fe6256174133a7eb224
SHA1e884d30bea81da844468fc940cb5eff1f01dd78d
SHA25675e1f08d6fd3f1358b0d495f42f131459ad8803a8d74eba0ec42a2ddaf9d780a
SHA512cb16d3d1e311ecaf97d71d601bba9962c8d074519b2ff9bbd642228f84054ae9b32803a6a33f4e571ca628011cef85f0c6be1dadc82b21a6b35a97ca60b855bc
-
Filesize
72KB
MD5e3af8dea90e6b317bafc65fe8be9dbe6
SHA181d9896ea4efef5934dcb7ffea9e71232f77bbab
SHA256d76dbb9030aca1ef247efb79dccc4d0986201d4c7cc76edfcb86eebbc31f42a3
SHA512cb62c0134a07e49b40b358dc433165be554ceb27b5a0d2e73c3cae7a0443180ef804f50572307737bda1a1b3bc222e53d2cc735840d0ada841e840595df05728
-
Filesize
72KB
MD5e3af8dea90e6b317bafc65fe8be9dbe6
SHA181d9896ea4efef5934dcb7ffea9e71232f77bbab
SHA256d76dbb9030aca1ef247efb79dccc4d0986201d4c7cc76edfcb86eebbc31f42a3
SHA512cb62c0134a07e49b40b358dc433165be554ceb27b5a0d2e73c3cae7a0443180ef804f50572307737bda1a1b3bc222e53d2cc735840d0ada841e840595df05728
-
Filesize
72KB
MD5dcabd0d81699dbeb8224ba26f6b2cd14
SHA18783a4982d92ed03751d18fbbd40345c4b1d5cbd
SHA25672089e2411349d2fa6e41d4daa449912d370774430d2d6de3641895ee531c160
SHA51269a6a1ca80cce19528f1c3951d6a265c4ee02a45bc34a420d8d2f07aedf0e6336a2390be16e3e3673478572dbbd8c627b98e731ea61f49a829428026375e253a
-
Filesize
72KB
MD5dcabd0d81699dbeb8224ba26f6b2cd14
SHA18783a4982d92ed03751d18fbbd40345c4b1d5cbd
SHA25672089e2411349d2fa6e41d4daa449912d370774430d2d6de3641895ee531c160
SHA51269a6a1ca80cce19528f1c3951d6a265c4ee02a45bc34a420d8d2f07aedf0e6336a2390be16e3e3673478572dbbd8c627b98e731ea61f49a829428026375e253a
-
Filesize
72KB
MD5b998749e9867aa08752856c68a59c3ab
SHA1ff2ddf362c053e8f9f7b3cca42a0520846e09ab6
SHA2566fbe900562533f3f6abaf56c75a73ab51973fb37f19bbdbccb16660ff016cfe8
SHA5121dad952071789925a5a76f7b42b4d6da81a96327f1c15e37d98ca235f31739f11c167a9dc6237b9cfe6d5e42ef6454746de551ff09a492df35b5a16ed8117e8c
-
Filesize
72KB
MD5b998749e9867aa08752856c68a59c3ab
SHA1ff2ddf362c053e8f9f7b3cca42a0520846e09ab6
SHA2566fbe900562533f3f6abaf56c75a73ab51973fb37f19bbdbccb16660ff016cfe8
SHA5121dad952071789925a5a76f7b42b4d6da81a96327f1c15e37d98ca235f31739f11c167a9dc6237b9cfe6d5e42ef6454746de551ff09a492df35b5a16ed8117e8c
-
Filesize
72KB
MD549493567756712ca6d2e16732ba6b03d
SHA1b62a0acef09121e8c0b60d80d1b1c1d30f7634c9
SHA2564045d78f2d32c7d6cca943435a9e87456bcc35cd11719f182764c87ca3ef99e1
SHA512c5a07e6c502d364a2241ac80f2a3dac55faf39ea8c31919b9663a7ca2a7dbfa9e0f4e03ce3aad76763b8be88ddb6e30ea2a3a8f2d6cdd45267532067fac4ac5b
-
Filesize
72KB
MD549493567756712ca6d2e16732ba6b03d
SHA1b62a0acef09121e8c0b60d80d1b1c1d30f7634c9
SHA2564045d78f2d32c7d6cca943435a9e87456bcc35cd11719f182764c87ca3ef99e1
SHA512c5a07e6c502d364a2241ac80f2a3dac55faf39ea8c31919b9663a7ca2a7dbfa9e0f4e03ce3aad76763b8be88ddb6e30ea2a3a8f2d6cdd45267532067fac4ac5b
-
Filesize
72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
Filesize
72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
Filesize72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
Filesize72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD593b9ee584f6134bfd99e21814b44ff96
SHA19429c096c8cb613c74d2d6bf2a6f6998e5a116d2
SHA256296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296
SHA51214499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3
-
Filesize
72KB
MD593b9ee584f6134bfd99e21814b44ff96
SHA19429c096c8cb613c74d2d6bf2a6f6998e5a116d2
SHA256296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296
SHA51214499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3
-
Filesize
72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
Filesize
72KB
MD5873938d9b37f614ce72a7130c14d049c
SHA1bad9b8d7f6efec2dc24d4fe67c3652e824945aed
SHA25660794219db7f08fcf54bedddc05285e626d2bb0d940e764d1f8dfc57be40db8f
SHA5120aed2c0c3370b924002ab4bf186726d5938e8dc85880130776154be01bcc3aa6564f388184ef2dcabccbb0b410cffea68aad0405520a4984509956342a838ce1
-
Filesize
72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86
-
Filesize
72KB
MD5fdfc459eefd9ba9133a92c8cbb01f2ed
SHA1d1d24d84d0a9c993573462c537a1ada9b1fac4ea
SHA256795ab61a8d698ade8bf11648d5ffae8f6a1f0f56e63f78d1bb5862cee0539c23
SHA5123369c9a1a012e5ccdd567034161c4e06546e09187dd05f7e8bcaee776ae246897e5c8980fd156544f643658ec86d1f68704f4a26142aae687457a17775a41a86