Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe
Resource
win10v2004-20220812-en
General
-
Target
c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe
-
Size
72KB
-
MD5
03012941d447756c6a9578faccd75589
-
SHA1
1edd7357d47e75f492da5e7ac94d2d8354226c63
-
SHA256
c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226
-
SHA512
37f6692956be63f04d518fc2289d5e5b29f8218920f687749f8782e250fde30283141894df0fb59d6e82793a5942f153aed09c93f66d35cda2f4e0abb5033c08
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2v:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPb
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe -
Executes dropped EXE 64 IoCs
pid Process 860 backup.exe 464 backup.exe 1496 backup.exe 884 backup.exe 1692 backup.exe 680 System Restore.exe 972 backup.exe 316 backup.exe 1804 backup.exe 1616 backup.exe 1344 backup.exe 1428 backup.exe 876 backup.exe 976 backup.exe 1404 update.exe 1972 backup.exe 2004 backup.exe 1764 backup.exe 524 backup.exe 656 backup.exe 1924 update.exe 884 backup.exe 1864 backup.exe 304 backup.exe 1564 backup.exe 1656 backup.exe 1736 backup.exe 748 backup.exe 592 backup.exe 2044 backup.exe 1616 backup.exe 1964 backup.exe 1932 backup.exe 924 backup.exe 2032 backup.exe 2036 backup.exe 1448 backup.exe 1780 System Restore.exe 1412 backup.exe 968 backup.exe 1816 backup.exe 1612 backup.exe 300 backup.exe 516 backup.exe 1508 backup.exe 1532 backup.exe 1348 backup.exe 856 backup.exe 1416 backup.exe 1552 backup.exe 1132 backup.exe 1536 backup.exe 1632 backup.exe 1812 backup.exe 1564 backup.exe 1788 backup.exe 1352 backup.exe 612 backup.exe 1688 update.exe 276 backup.exe 376 data.exe 1180 backup.exe 1984 backup.exe 1332 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 316 backup.exe 316 backup.exe 1804 backup.exe 1804 backup.exe 316 backup.exe 316 backup.exe 1344 backup.exe 1344 backup.exe 1428 backup.exe 1428 backup.exe 1344 backup.exe 1344 backup.exe 976 backup.exe 1404 update.exe 1404 update.exe 1404 update.exe 1344 backup.exe 1344 backup.exe 316 backup.exe 316 backup.exe 1404 update.exe 1404 update.exe 976 backup.exe 976 backup.exe 1764 backup.exe 1764 backup.exe 1764 backup.exe 316 backup.exe 316 backup.exe 1404 update.exe 1924 update.exe 1924 update.exe 1924 update.exe 1344 backup.exe 976 backup.exe 1344 backup.exe 976 backup.exe 1924 update.exe 1864 backup.exe 1924 update.exe 1864 backup.exe 304 backup.exe 304 backup.exe 304 backup.exe 1708 backup.exe 1708 backup.exe 1972 backup.exe 1972 backup.exe 884 backup.exe 884 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe update.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe update.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\update.exe update.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\System Restore.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe update.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe update.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe update.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\de-DE\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe update.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe System Restore.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe System Restore.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\Chess\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\data.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 860 backup.exe 464 backup.exe 1496 backup.exe 884 backup.exe 1692 backup.exe 680 System Restore.exe 972 backup.exe 316 backup.exe 1804 backup.exe 1616 backup.exe 1344 backup.exe 1428 backup.exe 876 backup.exe 976 backup.exe 1404 update.exe 1972 backup.exe 524 backup.exe 1764 backup.exe 1924 update.exe 656 backup.exe 884 backup.exe 1708 backup.exe 1864 backup.exe 1656 backup.exe 304 backup.exe 1564 backup.exe 592 backup.exe 748 backup.exe 1736 backup.exe 2044 backup.exe 1964 backup.exe 924 backup.exe 1932 backup.exe 2032 backup.exe 1616 backup.exe 2036 backup.exe 1448 backup.exe 1412 backup.exe 968 backup.exe 1780 System Restore.exe 1816 backup.exe 1612 backup.exe 300 backup.exe 516 backup.exe 1508 backup.exe 1348 backup.exe 856 backup.exe 1532 backup.exe 1416 backup.exe 1552 backup.exe 1132 backup.exe 1536 backup.exe 1632 backup.exe 1352 backup.exe 612 backup.exe 1564 backup.exe 1688 update.exe 1812 backup.exe 1788 backup.exe 276 backup.exe 376 data.exe 1984 backup.exe 1180 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 860 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 28 PID 1628 wrote to memory of 860 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 28 PID 1628 wrote to memory of 860 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 28 PID 1628 wrote to memory of 860 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 28 PID 1628 wrote to memory of 464 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 29 PID 1628 wrote to memory of 464 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 29 PID 1628 wrote to memory of 464 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 29 PID 1628 wrote to memory of 464 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 29 PID 1628 wrote to memory of 1496 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 30 PID 1628 wrote to memory of 1496 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 30 PID 1628 wrote to memory of 1496 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 30 PID 1628 wrote to memory of 1496 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 30 PID 1628 wrote to memory of 884 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 31 PID 1628 wrote to memory of 884 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 31 PID 1628 wrote to memory of 884 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 31 PID 1628 wrote to memory of 884 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 31 PID 1628 wrote to memory of 1692 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 32 PID 1628 wrote to memory of 1692 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 32 PID 1628 wrote to memory of 1692 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 32 PID 1628 wrote to memory of 1692 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 32 PID 1628 wrote to memory of 680 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 33 PID 1628 wrote to memory of 680 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 33 PID 1628 wrote to memory of 680 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 33 PID 1628 wrote to memory of 680 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 33 PID 1628 wrote to memory of 972 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 34 PID 1628 wrote to memory of 972 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 34 PID 1628 wrote to memory of 972 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 34 PID 1628 wrote to memory of 972 1628 c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe 34 PID 860 wrote to memory of 316 860 backup.exe 35 PID 860 wrote to memory of 316 860 backup.exe 35 PID 860 wrote to memory of 316 860 backup.exe 35 PID 860 wrote to memory of 316 860 backup.exe 35 PID 316 wrote to memory of 1804 316 backup.exe 36 PID 316 wrote to memory of 1804 316 backup.exe 36 PID 316 wrote to memory of 1804 316 backup.exe 36 PID 316 wrote to memory of 1804 316 backup.exe 36 PID 1804 wrote to memory of 1616 1804 backup.exe 37 PID 1804 wrote to memory of 1616 1804 backup.exe 37 PID 1804 wrote to memory of 1616 1804 backup.exe 37 PID 1804 wrote to memory of 1616 1804 backup.exe 37 PID 316 wrote to memory of 1344 316 backup.exe 38 PID 316 wrote to memory of 1344 316 backup.exe 38 PID 316 wrote to memory of 1344 316 backup.exe 38 PID 316 wrote to memory of 1344 316 backup.exe 38 PID 1344 wrote to memory of 1428 1344 backup.exe 39 PID 1344 wrote to memory of 1428 1344 backup.exe 39 PID 1344 wrote to memory of 1428 1344 backup.exe 39 PID 1344 wrote to memory of 1428 1344 backup.exe 39 PID 1428 wrote to memory of 876 1428 backup.exe 40 PID 1428 wrote to memory of 876 1428 backup.exe 40 PID 1428 wrote to memory of 876 1428 backup.exe 40 PID 1428 wrote to memory of 876 1428 backup.exe 40 PID 1344 wrote to memory of 976 1344 backup.exe 41 PID 1344 wrote to memory of 976 1344 backup.exe 41 PID 1344 wrote to memory of 976 1344 backup.exe 41 PID 1344 wrote to memory of 976 1344 backup.exe 41 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 976 wrote to memory of 1404 976 backup.exe 42 PID 1344 wrote to memory of 1972 1344 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe"C:\Users\Admin\AppData\Local\Temp\c9b85b4c703075b4ba69257988911472306a978d53398ccf3d3ac13a40231226.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2110582717\backup.exeC:\Users\Admin\AppData\Local\Temp\2110582717\backup.exe C:\Users\Admin\AppData\Local\Temp\2110582717\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:876
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Program Files\Common Files\Microsoft Shared\update.exe"C:\Program Files\Common Files\Microsoft Shared\update.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1404 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1924 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:304
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵PID:1060
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Drops file in Program Files directory
PID:1216 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- System policy modification
PID:1348
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1796
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1612 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1572
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Disables RegEdit via registry modification
PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:892
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:524
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1564
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1412 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:300
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1132
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:300
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
PID:1592
-
-
-
C:\Program Files\Common Files\System\de-DE\data.exe"C:\Program Files\Common Files\System\de-DE\data.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1204
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1808
-
-
C:\Program Files\Common Files\System\es-ES\System Restore.exe"C:\Program Files\Common Files\System\es-ES\System Restore.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:376
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:968
-
-
C:\Program Files\Common Files\System\it-IT\update.exe"C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1612
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1416
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
C:\Program Files\DVD Maker\ja-JP\data.exe"C:\Program Files\DVD Maker\ja-JP\data.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:376
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1180 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1196 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- System policy modification
PID:796
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Disables RegEdit via registry modification
PID:1448
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- System policy modification
PID:1204
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:920
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:884 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:856
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1812
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1076
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1632
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1060 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1648 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵PID:1780
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵
- System policy modification
PID:1536
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Disables RegEdit via registry modification
PID:464
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1392 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1708
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:792
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1564
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- System policy modification
PID:1768 -
C:\Program Files\Java\jdk1.7.0_80\update.exe"C:\Program Files\Java\jdk1.7.0_80\update.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:948 -
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:464
-
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵PID:1968
-
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:1948
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1364 -
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵
- Disables RegEdit via registry modification
PID:1008 -
C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\7⤵PID:1808
-
-
C:\Program Files\Microsoft Games\Chess\en-US\backup.exe"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\7⤵PID:1744
-
-
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵PID:1704
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1892
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:2004 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1708 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1656 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2044
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1816
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1688
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1332 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1796
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:792
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1580 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1592
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:976
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1656
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1820 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:304
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:268
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:924
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1544 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- Disables RegEdit via registry modification
PID:1244
-
-
-
-
-
C:\Program Files (x86)\Common Files\System Restore.exe"C:\Program Files (x86)\Common Files\System Restore.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
PID:548 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
- System policy modification
PID:544 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1632
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1076
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1204
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1772 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- System policy modification
PID:1972
-
-
C:\Program Files (x86)\Google\Policies\data.exe"C:\Program Files (x86)\Google\Policies\data.exe" C:\Program Files (x86)\Google\Policies\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1164
-
-
C:\Program Files (x86)\Google\Temp\System Restore.exe"C:\Program Files (x86)\Google\Temp\System Restore.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:300
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1168 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:1224
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:1952
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:1108
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2008
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:656 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:592 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1348
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:612
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:276
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Disables RegEdit via registry modification
PID:544
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1348
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:1164
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1564
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
- Modifies visibility of file extensions in Explorer
PID:1812
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Disables RegEdit via registry modification
PID:1776 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- System policy modification
PID:300
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1948
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:972
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:1620 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1868
-
-
C:\Windows\AppCompat\data.exeC:\Windows\AppCompat\data.exe C:\Windows\AppCompat\5⤵PID:844
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:792
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:464
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:972
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD5c0a060e53ace3906925f445abf77d7c9
SHA1d62098f165f8d5ddb1c518859dda93eb8ed78ecb
SHA25693706bc6b699d95c04dbe6a2dd8c063314e302eeda85b7da01b5a30aad1b9201
SHA512c7922039aa7d0b3baceff2ff1f0f55cd5113cf0f4ffe555e87593bccf69b58ce78ba0e624ae6c8264d100a67d19bedf17ffa63dbefa2656bbe05954496922579
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD51f873249dd69ffa53a6bb82b2a7a4227
SHA15cd1558f12c308d3244a7ffa2e7fb3b950e4f3c4
SHA256e7dcd7a32146d55c67f45952adaad7191e472806a8a797b54af57637cae09483
SHA512ec380665d63a5b43c8d3803e56f5fbe1aea682ac9e6c4ffa918c67a85243ab07f2880d542f8888232075d395dafbe85c49d33fd543b32ba6d41842586db0507c
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD58047e12cf05967f1d102db68982d0652
SHA112c70f3d2fd8007ff421c027a82459f5127ca9c5
SHA256582649e6e6bdcccecb2be3bc7c987fb8de8c6ee7a935d63f02519c6290900fa0
SHA5126d7c6302879f325328b1deab8460c91f6b136c29372dedf30636e53df25d83216e2a197e31528756eb0f2fee49c7ea0e59a7428c9d930b83928c71c69e60a5a0
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD57f06b39d1fb087ea9d561a1b76a2bc29
SHA1673828143b426f36138ca86cb70735ab206d7eb5
SHA256c2f5f1000220908ea1139191115ef607982eae5734b27617434ea6e3404dab65
SHA5120c5a96a47fba8aa75c1c2147b0ed0fef6f55323a1f99de5d727a14b50f543ab762156f96a0beee4db929ffc74c486ebb82b950a0584ae3e71209b948e6220acb
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD57ad7fbba4ce3d31a38b55f50dbff84fe
SHA12c6a754c93840c44a79b0c2a8703e1e59d2066b3
SHA25617fc476bd70683bf8ed2df5484b529371198ad61ea92d6a9a55ec7546b389a09
SHA512d9c62a13775179d5dec173a82aea48a98791bb60db14bef955cfc2dfadb40c1202f894741f92b63b60bf4fc376cf0b84be26d265b69089103cee6ef903f2e2f0
-
Filesize
72KB
MD57ad7fbba4ce3d31a38b55f50dbff84fe
SHA12c6a754c93840c44a79b0c2a8703e1e59d2066b3
SHA25617fc476bd70683bf8ed2df5484b529371198ad61ea92d6a9a55ec7546b389a09
SHA512d9c62a13775179d5dec173a82aea48a98791bb60db14bef955cfc2dfadb40c1202f894741f92b63b60bf4fc376cf0b84be26d265b69089103cee6ef903f2e2f0
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD5c0a060e53ace3906925f445abf77d7c9
SHA1d62098f165f8d5ddb1c518859dda93eb8ed78ecb
SHA25693706bc6b699d95c04dbe6a2dd8c063314e302eeda85b7da01b5a30aad1b9201
SHA512c7922039aa7d0b3baceff2ff1f0f55cd5113cf0f4ffe555e87593bccf69b58ce78ba0e624ae6c8264d100a67d19bedf17ffa63dbefa2656bbe05954496922579
-
Filesize
72KB
MD5c0a060e53ace3906925f445abf77d7c9
SHA1d62098f165f8d5ddb1c518859dda93eb8ed78ecb
SHA25693706bc6b699d95c04dbe6a2dd8c063314e302eeda85b7da01b5a30aad1b9201
SHA512c7922039aa7d0b3baceff2ff1f0f55cd5113cf0f4ffe555e87593bccf69b58ce78ba0e624ae6c8264d100a67d19bedf17ffa63dbefa2656bbe05954496922579
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD51f873249dd69ffa53a6bb82b2a7a4227
SHA15cd1558f12c308d3244a7ffa2e7fb3b950e4f3c4
SHA256e7dcd7a32146d55c67f45952adaad7191e472806a8a797b54af57637cae09483
SHA512ec380665d63a5b43c8d3803e56f5fbe1aea682ac9e6c4ffa918c67a85243ab07f2880d542f8888232075d395dafbe85c49d33fd543b32ba6d41842586db0507c
-
Filesize
72KB
MD51f873249dd69ffa53a6bb82b2a7a4227
SHA15cd1558f12c308d3244a7ffa2e7fb3b950e4f3c4
SHA256e7dcd7a32146d55c67f45952adaad7191e472806a8a797b54af57637cae09483
SHA512ec380665d63a5b43c8d3803e56f5fbe1aea682ac9e6c4ffa918c67a85243ab07f2880d542f8888232075d395dafbe85c49d33fd543b32ba6d41842586db0507c
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD576ca9de9d0f3b0a53709f9cad13ff082
SHA1ac58246b31a81f59c8035fbb188bcce622bb00f8
SHA256e2c8dadd0de3a94b66411fd9349e6c68161ee885d34f643e9595991a090af980
SHA5121ebfde971d70c242c98dd956149a0839103b3a5222822ea10072eceee3aef5265a0905815584ed235d8adffadbd316351aaf3e8153cf11d0ad653b2fc38cc938
-
Filesize
72KB
MD58047e12cf05967f1d102db68982d0652
SHA112c70f3d2fd8007ff421c027a82459f5127ca9c5
SHA256582649e6e6bdcccecb2be3bc7c987fb8de8c6ee7a935d63f02519c6290900fa0
SHA5126d7c6302879f325328b1deab8460c91f6b136c29372dedf30636e53df25d83216e2a197e31528756eb0f2fee49c7ea0e59a7428c9d930b83928c71c69e60a5a0
-
Filesize
72KB
MD58047e12cf05967f1d102db68982d0652
SHA112c70f3d2fd8007ff421c027a82459f5127ca9c5
SHA256582649e6e6bdcccecb2be3bc7c987fb8de8c6ee7a935d63f02519c6290900fa0
SHA5126d7c6302879f325328b1deab8460c91f6b136c29372dedf30636e53df25d83216e2a197e31528756eb0f2fee49c7ea0e59a7428c9d930b83928c71c69e60a5a0
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD52b09d6ede7066ad2597d05e412241199
SHA19d179497c311f3f674c4b47c8e9736b8f2832923
SHA256f8d7d7128e75e3f62a124175009906669c67ed4276aa53d4b12d949204a108fb
SHA512d42a1faef20e372fb547a7aa887450fe8e2118a0f2306d3ec1e2775a0e31f809fa26743a85a3565836cf3ef74761cb138edad0df7851ac48d1422082cb2ff437
-
Filesize
72KB
MD57f06b39d1fb087ea9d561a1b76a2bc29
SHA1673828143b426f36138ca86cb70735ab206d7eb5
SHA256c2f5f1000220908ea1139191115ef607982eae5734b27617434ea6e3404dab65
SHA5120c5a96a47fba8aa75c1c2147b0ed0fef6f55323a1f99de5d727a14b50f543ab762156f96a0beee4db929ffc74c486ebb82b950a0584ae3e71209b948e6220acb
-
Filesize
72KB
MD57f06b39d1fb087ea9d561a1b76a2bc29
SHA1673828143b426f36138ca86cb70735ab206d7eb5
SHA256c2f5f1000220908ea1139191115ef607982eae5734b27617434ea6e3404dab65
SHA5120c5a96a47fba8aa75c1c2147b0ed0fef6f55323a1f99de5d727a14b50f543ab762156f96a0beee4db929ffc74c486ebb82b950a0584ae3e71209b948e6220acb
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD5da17e602f144b12f0af14fc44129a382
SHA18ece24d2c6c7706c9d0d9159dbaae01653f0bf8b
SHA25663ab41fa116f3c4c17e370dd61078e8231686cd70e5ebf40ef507601f1f2fd3c
SHA51259a0b816e5553473a6f7185486b8a58a7958159859f8a0e3293e66093068270dce03fde1a73f68c028e3298c47b64ef8946ed38f081e03b32f2a89c330a2eb29
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f
-
Filesize
72KB
MD558c19ac065f3f526d0c03d69e49dcf50
SHA1536703a0dd8c2c89b670d5e15c2c2d1269693c89
SHA256f694e20ce4949466724be1dd1d73701c39a3542873112c6523a39cd9919b1282
SHA512ca7b0303113afaba49dcb655a560269c98aac7daa9432802b7038b1c74a27c0679b63717bba47eb1ddb260d4cf55c27a2f74634ed40435e66b2b0f8e2c128d5f