Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe
Resource
win10v2004-20220812-en
General
-
Target
542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe
-
Size
72KB
-
MD5
0cd80e7db3a774592c4e31da708c072e
-
SHA1
4f4cd6480c2e96496dbba401cdb400b255899ad1
-
SHA256
542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540
-
SHA512
6ea57b3562517aded33990a152469e94dd865b7885cfed0c6ebf3712bb87acf99813389636fb57aa7600e5a8eced292c4bd2ba1e77ddc37b0811d6f96fca2d48
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2f:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrT
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2244 backup.exe 3752 backup.exe 3968 backup.exe 5064 backup.exe 4988 backup.exe 4944 backup.exe 2780 backup.exe 1376 System Restore.exe 1444 backup.exe 2688 backup.exe 4964 backup.exe 1816 System Restore.exe 1428 backup.exe 1380 backup.exe 3036 backup.exe 4624 backup.exe 3308 backup.exe 2312 backup.exe 1460 backup.exe 2256 backup.exe 2460 backup.exe 4600 backup.exe 3832 backup.exe 2448 backup.exe 3084 backup.exe 4532 backup.exe 2664 backup.exe 2052 backup.exe 4628 backup.exe 1708 backup.exe 1120 backup.exe 4888 backup.exe 4920 backup.exe 1448 data.exe 2084 backup.exe 4280 backup.exe 3460 backup.exe 3272 backup.exe 2168 data.exe 3804 update.exe 1188 data.exe 3816 backup.exe 4660 backup.exe 2820 backup.exe 2276 backup.exe 2192 backup.exe 4120 backup.exe 2160 backup.exe 1256 data.exe 4468 backup.exe 3092 backup.exe 3364 backup.exe 804 backup.exe 5020 System Restore.exe 5012 System Restore.exe 4928 backup.exe 4988 backup.exe 5032 backup.exe 832 backup.exe 2036 backup.exe 4848 backup.exe 4328 backup.exe 2856 backup.exe 3632 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\update.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\update.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe data.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\update.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe data.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\update.exe backup.exe File opened for modification C:\Program Files\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Update\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe backup.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe System Restore.exe File opened for modification C:\Windows\addins\System Restore.exe backup.exe File opened for modification C:\Windows\appcompat\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe backup.exe File opened for modification C:\Windows\appcompat\encapsulation\System Restore.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 2244 backup.exe 3752 backup.exe 3968 backup.exe 5064 backup.exe 4988 backup.exe 4944 backup.exe 2780 backup.exe 1376 System Restore.exe 1444 backup.exe 2688 backup.exe 4964 backup.exe 1816 System Restore.exe 1428 backup.exe 1380 backup.exe 3036 backup.exe 4624 backup.exe 3308 backup.exe 2312 backup.exe 1460 backup.exe 2256 backup.exe 2460 backup.exe 4600 backup.exe 3832 backup.exe 2448 backup.exe 3084 backup.exe 4532 backup.exe 2664 backup.exe 2052 backup.exe 4628 backup.exe 1708 backup.exe 1120 backup.exe 4888 backup.exe 4920 backup.exe 1448 data.exe 2084 backup.exe 4280 backup.exe 3460 backup.exe 3272 backup.exe 2168 data.exe 3804 update.exe 1188 data.exe 3816 backup.exe 4660 backup.exe 2820 backup.exe 2276 backup.exe 2192 backup.exe 1256 data.exe 4468 backup.exe 4120 backup.exe 2160 backup.exe 3092 backup.exe 3364 backup.exe 804 backup.exe 5012 System Restore.exe 4928 backup.exe 4988 backup.exe 5020 System Restore.exe 5032 backup.exe 832 backup.exe 2036 backup.exe 4848 backup.exe 4328 backup.exe 2856 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2244 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 79 PID 1732 wrote to memory of 2244 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 79 PID 1732 wrote to memory of 2244 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 79 PID 1732 wrote to memory of 3752 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 80 PID 1732 wrote to memory of 3752 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 80 PID 1732 wrote to memory of 3752 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 80 PID 1732 wrote to memory of 3968 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 81 PID 1732 wrote to memory of 3968 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 81 PID 1732 wrote to memory of 3968 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 81 PID 1732 wrote to memory of 5064 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 82 PID 1732 wrote to memory of 5064 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 82 PID 1732 wrote to memory of 5064 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 82 PID 1732 wrote to memory of 4988 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 83 PID 1732 wrote to memory of 4988 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 83 PID 1732 wrote to memory of 4988 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 83 PID 1732 wrote to memory of 4944 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 84 PID 1732 wrote to memory of 4944 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 84 PID 1732 wrote to memory of 4944 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 84 PID 1732 wrote to memory of 2780 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 85 PID 1732 wrote to memory of 2780 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 85 PID 1732 wrote to memory of 2780 1732 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe 85 PID 2244 wrote to memory of 1376 2244 backup.exe 86 PID 2244 wrote to memory of 1376 2244 backup.exe 86 PID 2244 wrote to memory of 1376 2244 backup.exe 86 PID 1376 wrote to memory of 1444 1376 System Restore.exe 87 PID 1376 wrote to memory of 1444 1376 System Restore.exe 87 PID 1376 wrote to memory of 1444 1376 System Restore.exe 87 PID 1376 wrote to memory of 2688 1376 System Restore.exe 89 PID 1376 wrote to memory of 2688 1376 System Restore.exe 89 PID 1376 wrote to memory of 2688 1376 System Restore.exe 89 PID 1376 wrote to memory of 4964 1376 System Restore.exe 90 PID 1376 wrote to memory of 4964 1376 System Restore.exe 90 PID 1376 wrote to memory of 4964 1376 System Restore.exe 90 PID 4964 wrote to memory of 1816 4964 backup.exe 92 PID 4964 wrote to memory of 1816 4964 backup.exe 92 PID 4964 wrote to memory of 1816 4964 backup.exe 92 PID 1816 wrote to memory of 1428 1816 System Restore.exe 93 PID 1816 wrote to memory of 1428 1816 System Restore.exe 93 PID 1816 wrote to memory of 1428 1816 System Restore.exe 93 PID 4964 wrote to memory of 1380 4964 backup.exe 94 PID 4964 wrote to memory of 1380 4964 backup.exe 94 PID 4964 wrote to memory of 1380 4964 backup.exe 94 PID 1380 wrote to memory of 3036 1380 backup.exe 95 PID 1380 wrote to memory of 3036 1380 backup.exe 95 PID 1380 wrote to memory of 3036 1380 backup.exe 95 PID 1380 wrote to memory of 4624 1380 backup.exe 96 PID 1380 wrote to memory of 4624 1380 backup.exe 96 PID 1380 wrote to memory of 4624 1380 backup.exe 96 PID 4624 wrote to memory of 3308 4624 backup.exe 97 PID 4624 wrote to memory of 3308 4624 backup.exe 97 PID 4624 wrote to memory of 3308 4624 backup.exe 97 PID 4624 wrote to memory of 2312 4624 backup.exe 98 PID 4624 wrote to memory of 2312 4624 backup.exe 98 PID 4624 wrote to memory of 2312 4624 backup.exe 98 PID 2312 wrote to memory of 1460 2312 backup.exe 99 PID 2312 wrote to memory of 1460 2312 backup.exe 99 PID 2312 wrote to memory of 1460 2312 backup.exe 99 PID 2312 wrote to memory of 2256 2312 backup.exe 100 PID 2312 wrote to memory of 2256 2312 backup.exe 100 PID 2312 wrote to memory of 2256 2312 backup.exe 100 PID 2312 wrote to memory of 2460 2312 backup.exe 101 PID 2312 wrote to memory of 2460 2312 backup.exe 101 PID 2312 wrote to memory of 2460 2312 backup.exe 101 PID 2312 wrote to memory of 4600 2312 backup.exe 102 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe"C:\Users\Admin\AppData\Local\Temp\542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2210577132\backup.exeC:\Users\Admin\AppData\Local\Temp\2210577132\backup.exe C:\Users\Admin\AppData\Local\Temp\2210577132\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2244 -
C:\System Restore.exe"\System Restore.exe" \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1376 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2688
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4964 -
C:\Program Files\7-Zip\System Restore.exe"C:\Program Files\7-Zip\System Restore.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1428
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3036
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3308
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1460
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2460
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4600
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3832
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2448
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3084
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4532
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2052
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4628
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4888
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4920 -
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2084
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4280
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3460
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3272
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3804
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2820
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4120
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2192
-
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3092
-
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5032
-
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2856
-
-
C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
PID:4224
-
-
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\8⤵PID:4696
-
-
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4856
-
-
C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4952
-
-
C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
PID:3120
-
-
C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\8⤵
- Disables RegEdit via registry modification
PID:4116
-
-
C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
PID:4020
-
-
C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\8⤵
- Disables RegEdit via registry modification
PID:5032
-
-
C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
PID:1920
-
-
C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2052
-
-
C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\8⤵PID:4764
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1256 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Executes dropped EXE
PID:3632
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵PID:372
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4612
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵PID:2492
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:3332
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵PID:4252
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- System policy modification
PID:1996
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵PID:2008
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- Drops file in Program Files directory
PID:4004 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵PID:3396
-
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4984
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵PID:3456
-
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵PID:4432
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3816
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4468 -
C:\Program Files\Common Files\System\ado\System Restore.exe"C:\Program Files\Common Files\System\ado\System Restore.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5012 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4848
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2008
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4276
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:3464
-
-
C:\Program Files\Common Files\System\ado\it-IT\update.exe"C:\Program Files\Common Files\System\ado\it-IT\update.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
PID:1088
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:3084
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:1120
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2220
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
PID:4288
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
PID:4888
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
PID:1452
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Disables RegEdit via registry modification
PID:3048
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2692
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2276 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:804 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4928 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
PID:3512
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
PID:1920
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
PID:3276
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Modifies visibility of file extensions in Explorer
PID:1564
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1916
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4524
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Modifies visibility of file extensions in Explorer
PID:3840
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3408
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1472
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:4280 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Disables RegEdit via registry modification
PID:4644
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4904
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1692
-
-
C:\Program Files\Internet Explorer\fr-FR\update.exe"C:\Program Files\Internet Explorer\fr-FR\update.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
PID:4884
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1856
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:1292
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
PID:4444 -
C:\Program Files\Java\jdk1.8.0_66\data.exe"C:\Program Files\Java\jdk1.8.0_66\data.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:5036 -
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- System policy modification
PID:840 -
C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\8⤵PID:4116
-
-
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\8⤵PID:4740
-
-
-
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
- System policy modification
PID:3304
-
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4660 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3364 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5020 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4328
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:3524 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1876 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Disables RegEdit via registry modification
PID:4288
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Disables RegEdit via registry modification
PID:2440 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1528
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
- Modifies visibility of file extensions in Explorer
PID:4748
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1388
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵PID:2924
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵PID:4912
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:4372
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵PID:4220
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2148 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
- Drops file in Program Files directory
- System policy modification
PID:3952 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵
- Disables RegEdit via registry modification
PID:1544
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵PID:3836
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵PID:1328
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:5100 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
- System policy modification
PID:5052 -
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵PID:1308
-
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1016 -
C:\Program Files (x86)\Google\Temp\update.exe"C:\Program Files (x86)\Google\Temp\update.exe" C:\Program Files (x86)\Google\Temp\6⤵
- System policy modification
PID:2272
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:3508 -
C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe"C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\7⤵PID:5088
-
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1432
-
-
C:\Program Files (x86)\Google\CrashReports\update.exe"C:\Program Files (x86)\Google\CrashReports\update.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Disables RegEdit via registry modification
PID:3736
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:832 -
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵PID:1868
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:1664
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
PID:3036
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1260
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
PID:3836
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Modifies visibility of file extensions in Explorer
PID:4460
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Modifies visibility of file extensions in Explorer
PID:2364
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:3676
-
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵PID:2004
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3088 -
C:\Users\Admin\Pictures\Camera Roll\backup.exe"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\7⤵PID:4060
-
-
C:\Users\Admin\Pictures\Saved Pictures\backup.exe"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\7⤵
- Modifies visibility of file extensions in Explorer
PID:2576
-
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:2468
-
-
C:\Users\Admin\Searches\update.exeC:\Users\Admin\Searches\update.exe C:\Users\Admin\Searches\6⤵
- System policy modification
PID:2824
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵PID:5060
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
PID:4868 -
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1384
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
- Disables RegEdit via registry modification
PID:1348
-
-
C:\Users\Public\Documents\System Restore.exe"C:\Users\Public\Documents\System Restore.exe" C:\Users\Public\Documents\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:752
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:4100
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵PID:1916
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:1372 -
C:\Windows\addins\System Restore.exe"C:\Windows\addins\System Restore.exe" C:\Windows\addins\5⤵
- System policy modification
PID:1056
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:1756 -
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:3684 -
C:\Windows\appcompat\appraiser\Telemetry\backup.exeC:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵PID:3320
-
-
-
C:\Windows\appcompat\encapsulation\System Restore.exe"C:\Windows\appcompat\encapsulation\System Restore.exe" C:\Windows\appcompat\encapsulation\6⤵PID:3740
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4944
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2780
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\System Restore.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\System Restore.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\1⤵
- Disables RegEdit via registry modification
PID:3884
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\1⤵
- System policy modification
PID:1192
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:4696 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\2⤵PID:3904
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\1⤵PID:3276
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1868
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2344
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\1⤵PID:1716
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\1⤵PID:3884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD57814cf379b7c8ba3af275263ac1654c2
SHA10201cfa55973c6d84676ada42c15ad187d9450dc
SHA256fb890d7204609c35f37de1ddabcee367d7e156052029975180d56950bbe0a095
SHA512208bc83bfba9730e30edc67e3b7b07e3430d6c9829d40a4b97385a11c803b4879b30300bc6547f39d762338d1ca6603d051c56a50284f7e0577da7acf5c4d405
-
Filesize
72KB
MD57814cf379b7c8ba3af275263ac1654c2
SHA10201cfa55973c6d84676ada42c15ad187d9450dc
SHA256fb890d7204609c35f37de1ddabcee367d7e156052029975180d56950bbe0a095
SHA512208bc83bfba9730e30edc67e3b7b07e3430d6c9829d40a4b97385a11c803b4879b30300bc6547f39d762338d1ca6603d051c56a50284f7e0577da7acf5c4d405
-
Filesize
72KB
MD52d52d6591c97f3c6eb5bc8d87e8e82ce
SHA1a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb
SHA2562f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5
SHA5129f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f
-
Filesize
72KB
MD52d52d6591c97f3c6eb5bc8d87e8e82ce
SHA1a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb
SHA2562f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5
SHA5129f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f
-
Filesize
72KB
MD5a608f0f90ea07c5551a496d839eeefe0
SHA1eada435df4dcfcd96031cb27ed66dbc132fab2b6
SHA2562a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8
SHA51215b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6
-
Filesize
72KB
MD5a608f0f90ea07c5551a496d839eeefe0
SHA1eada435df4dcfcd96031cb27ed66dbc132fab2b6
SHA2562a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8
SHA51215b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6
-
Filesize
72KB
MD52d52d6591c97f3c6eb5bc8d87e8e82ce
SHA1a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb
SHA2562f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5
SHA5129f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f
-
Filesize
72KB
MD52d52d6591c97f3c6eb5bc8d87e8e82ce
SHA1a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb
SHA2562f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5
SHA5129f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f
-
Filesize
72KB
MD5a608f0f90ea07c5551a496d839eeefe0
SHA1eada435df4dcfcd96031cb27ed66dbc132fab2b6
SHA2562a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8
SHA51215b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6
-
Filesize
72KB
MD5a608f0f90ea07c5551a496d839eeefe0
SHA1eada435df4dcfcd96031cb27ed66dbc132fab2b6
SHA2562a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8
SHA51215b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6
-
Filesize
72KB
MD5ec631bcb63271d64466bf491783e6550
SHA1a423f5e5e2c5601c4e92808ca65ee5bdd261e214
SHA256eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef
SHA5124dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13
-
Filesize
72KB
MD5ec631bcb63271d64466bf491783e6550
SHA1a423f5e5e2c5601c4e92808ca65ee5bdd261e214
SHA256eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef
SHA5124dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13
-
Filesize
72KB
MD52d52d6591c97f3c6eb5bc8d87e8e82ce
SHA1a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb
SHA2562f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5
SHA5129f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f
-
Filesize
72KB
MD52d52d6591c97f3c6eb5bc8d87e8e82ce
SHA1a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb
SHA2562f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5
SHA5129f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f
-
Filesize
72KB
MD537cda5945fba47664776e6ec5460af78
SHA1061f0611615e0431f0733cf5bc7e604d6c00ce6d
SHA256106d5056ec592446b086d69f0e7c41dc96bf56b2b7bdce748ad9242559972060
SHA5129162437c787419a51c127118d80d29408e22b9d67aab44d68d646973eb23601b9bb30386a65a225e745e4b82e2177124849f53fed322b098bcd6b0216309f046
-
Filesize
72KB
MD537cda5945fba47664776e6ec5460af78
SHA1061f0611615e0431f0733cf5bc7e604d6c00ce6d
SHA256106d5056ec592446b086d69f0e7c41dc96bf56b2b7bdce748ad9242559972060
SHA5129162437c787419a51c127118d80d29408e22b9d67aab44d68d646973eb23601b9bb30386a65a225e745e4b82e2177124849f53fed322b098bcd6b0216309f046
-
Filesize
72KB
MD5ec631bcb63271d64466bf491783e6550
SHA1a423f5e5e2c5601c4e92808ca65ee5bdd261e214
SHA256eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef
SHA5124dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13
-
Filesize
72KB
MD5ec631bcb63271d64466bf491783e6550
SHA1a423f5e5e2c5601c4e92808ca65ee5bdd261e214
SHA256eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef
SHA5124dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5402608c79c49fc6fd599613cd6b22a7c
SHA174ef026c1366392f6608bc4d1c60fc5ed04b4e8e
SHA25685f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2
SHA51224a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD5ebeeafe22349449ca060b63532816fcd
SHA1b49571ff1093951df255c0628360245093477420
SHA256e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a
SHA512f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227
-
Filesize
72KB
MD575241375a32f913ff4424adf21d0aa89
SHA1cf9d0d748e527902e9ddc31dc4a1ef501f0661be
SHA256e478d6458214ef37d0028d5031436e9dd64ed86f9cbbf51b3a8b10d91ece277a
SHA51296e527da26eb569359fc9e4888062e845317ba0e1da98a81c97b9288958cc71e8482ff829bf62e124c378b316c052baf359b6676299520dfbdae9ae2728d6702
-
Filesize
72KB
MD575241375a32f913ff4424adf21d0aa89
SHA1cf9d0d748e527902e9ddc31dc4a1ef501f0661be
SHA256e478d6458214ef37d0028d5031436e9dd64ed86f9cbbf51b3a8b10d91ece277a
SHA51296e527da26eb569359fc9e4888062e845317ba0e1da98a81c97b9288958cc71e8482ff829bf62e124c378b316c052baf359b6676299520dfbdae9ae2728d6702
-
Filesize
72KB
MD56b7c5a1835ad6cbb1144072d114c628b
SHA146754f1ae29895760d23deb73f309da9b26f3fa9
SHA2562fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f
SHA5121eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c
-
Filesize
72KB
MD56b7c5a1835ad6cbb1144072d114c628b
SHA146754f1ae29895760d23deb73f309da9b26f3fa9
SHA2562fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f
SHA5121eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c
-
Filesize
72KB
MD56b7c5a1835ad6cbb1144072d114c628b
SHA146754f1ae29895760d23deb73f309da9b26f3fa9
SHA2562fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f
SHA5121eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c
-
Filesize
72KB
MD56b7c5a1835ad6cbb1144072d114c628b
SHA146754f1ae29895760d23deb73f309da9b26f3fa9
SHA2562fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f
SHA5121eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c
-
Filesize
72KB
MD56b7c5a1835ad6cbb1144072d114c628b
SHA146754f1ae29895760d23deb73f309da9b26f3fa9
SHA2562fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f
SHA5121eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c
-
Filesize
72KB
MD56b7c5a1835ad6cbb1144072d114c628b
SHA146754f1ae29895760d23deb73f309da9b26f3fa9
SHA2562fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f
SHA5121eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c
-
Filesize
72KB
MD596f5eb9ce57272ff7959161b45c7171f
SHA1489da0ed12141280540d30d23a655b788ec7b682
SHA2562a33fbd065527acc09d3202ff407a76049be9820c8563f828209bdaedfaeefc9
SHA512fca60814d20c380a54643c91e57b97d87778bd4d69864acbceb8e76b4da6d8f0331d262da9eea3c2b6b5628391fe1e259f0a5be45e33d701c17676951dbc6313
-
Filesize
72KB
MD596f5eb9ce57272ff7959161b45c7171f
SHA1489da0ed12141280540d30d23a655b788ec7b682
SHA2562a33fbd065527acc09d3202ff407a76049be9820c8563f828209bdaedfaeefc9
SHA512fca60814d20c380a54643c91e57b97d87778bd4d69864acbceb8e76b4da6d8f0331d262da9eea3c2b6b5628391fe1e259f0a5be45e33d701c17676951dbc6313
-
Filesize
72KB
MD52baeb27abedb9a7c571dda9bdf6cd506
SHA1be2ef378085aa7214324c682a2dd1149f13c275a
SHA2564d8dc2146e62840aa222753ca9617ac84f1025719573f9fd2f4a2c0a570d5357
SHA51268efe345c470508d08789312aff34ba16c0ca4cd1b84aafd33b0df87b03fdba485ff1e858ce5e6355914d671c5f789b2e4b18cae2e44dad411556f44467ff31f
-
Filesize
72KB
MD52baeb27abedb9a7c571dda9bdf6cd506
SHA1be2ef378085aa7214324c682a2dd1149f13c275a
SHA2564d8dc2146e62840aa222753ca9617ac84f1025719573f9fd2f4a2c0a570d5357
SHA51268efe345c470508d08789312aff34ba16c0ca4cd1b84aafd33b0df87b03fdba485ff1e858ce5e6355914d671c5f789b2e4b18cae2e44dad411556f44467ff31f
-
Filesize
72KB
MD5f4e1ebb9e5726defc26b12631b37ede1
SHA131eb5bcc8c1f5ae8af6fc557d3c2610c78ea6a8c
SHA25604946d73c418eda82028c5bc63a26316e0e1bb3d8e1b1c02acc1696028d8e890
SHA512a7232a89192b68d1c664e37d3045ded800c4d40cef3e9e0d3b9778ce9d57b04f9c36b082edf934e47b4d8ffe79b5aafd15b268c1b7f6c8f0ba8e86e35f5e9a88
-
Filesize
72KB
MD5f4e1ebb9e5726defc26b12631b37ede1
SHA131eb5bcc8c1f5ae8af6fc557d3c2610c78ea6a8c
SHA25604946d73c418eda82028c5bc63a26316e0e1bb3d8e1b1c02acc1696028d8e890
SHA512a7232a89192b68d1c664e37d3045ded800c4d40cef3e9e0d3b9778ce9d57b04f9c36b082edf934e47b4d8ffe79b5aafd15b268c1b7f6c8f0ba8e86e35f5e9a88
-
Filesize
72KB
MD50932b4d30effe0c2bddd2db011249d95
SHA102e6618b87aaa5dc0b60eff473983ed3506f3912
SHA2563a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d
SHA512a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2
-
Filesize
72KB
MD50932b4d30effe0c2bddd2db011249d95
SHA102e6618b87aaa5dc0b60eff473983ed3506f3912
SHA2563a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d
SHA512a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2
-
Filesize
72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
Filesize
72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
Filesize
72KB
MD50932b4d30effe0c2bddd2db011249d95
SHA102e6618b87aaa5dc0b60eff473983ed3506f3912
SHA2563a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d
SHA512a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2
-
Filesize
72KB
MD50932b4d30effe0c2bddd2db011249d95
SHA102e6618b87aaa5dc0b60eff473983ed3506f3912
SHA2563a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d
SHA512a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2
-
Filesize
72KB
MD50932b4d30effe0c2bddd2db011249d95
SHA102e6618b87aaa5dc0b60eff473983ed3506f3912
SHA2563a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d
SHA512a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2
-
Filesize
72KB
MD50932b4d30effe0c2bddd2db011249d95
SHA102e6618b87aaa5dc0b60eff473983ed3506f3912
SHA2563a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d
SHA512a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2
-
Filesize
72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
Filesize
72KB
MD55cece52fc3b3296e1b0b6fa59245fcd6
SHA11a6664de9f9a037b079b6266ae4869413d4fcfe4
SHA256e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08
SHA51297c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d
-
Filesize
72KB
MD539c126d8aeecd852027804aa5dc4fb21
SHA1549e466f358d4b63dca97f746197701507a7cd24
SHA256f35815f4e76d53248a4f344e110d9f211d1f7684fdbd73f35cbf0bbbd4c58865
SHA51264a7309c4d5ded03868b3a59089f241d130832d67292f0ad73d2254d3eb1e73fbb91a8642be7f8cf974930b9630a348f2d55b22ba57db8dc9730647e1816579f
-
Filesize
72KB
MD539c126d8aeecd852027804aa5dc4fb21
SHA1549e466f358d4b63dca97f746197701507a7cd24
SHA256f35815f4e76d53248a4f344e110d9f211d1f7684fdbd73f35cbf0bbbd4c58865
SHA51264a7309c4d5ded03868b3a59089f241d130832d67292f0ad73d2254d3eb1e73fbb91a8642be7f8cf974930b9630a348f2d55b22ba57db8dc9730647e1816579f