Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe
Resource
win10v2004-20221111-en
General
-
Target
fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe
-
Size
72KB
-
MD5
032d46a7c5d09ac0412669c6bdee0111
-
SHA1
8d70596df22989a2d185e69016c77edc7bce1d0c
-
SHA256
fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3
-
SHA512
69771f5ea9e77a4b10e678da87b11cfe553aa0d37e592fa478b9cd32db5e4572d5ed9bdc5506c1a8e2c64f3b9e5f8acc366b1ab5992ab62be37e39900109acc1
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2Q:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe -
Executes dropped EXE 64 IoCs
pid Process 1644 backup.exe 1400 backup.exe 828 backup.exe 2032 backup.exe 2000 backup.exe 1772 backup.exe 1488 backup.exe 1456 backup.exe 1340 backup.exe 1552 backup.exe 1204 backup.exe 584 backup.exe 1092 backup.exe 2012 System Restore.exe 1464 backup.exe 1632 backup.exe 1824 backup.exe 1432 backup.exe 1400 backup.exe 2036 backup.exe 2032 backup.exe 908 backup.exe 1692 backup.exe 1448 backup.exe 1712 data.exe 1208 backup.exe 1612 backup.exe 1132 backup.exe 1420 backup.exe 1424 backup.exe 564 backup.exe 1212 backup.exe 524 backup.exe 1536 backup.exe 1620 backup.exe 1104 backup.exe 1396 update.exe 1884 backup.exe 1816 backup.exe 1500 backup.exe 732 backup.exe 1632 data.exe 1680 backup.exe 948 backup.exe 1040 backup.exe 2020 backup.exe 1728 backup.exe 1696 backup.exe 2000 backup.exe 1280 backup.exe 1956 backup.exe 1576 backup.exe 1608 update.exe 1612 backup.exe 1096 backup.exe 1008 System Restore.exe 548 data.exe 684 backup.exe 1736 backup.exe 1812 backup.exe 748 backup.exe 1104 backup.exe 1940 backup.exe 112 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1456 backup.exe 1456 backup.exe 1340 backup.exe 1340 backup.exe 1456 backup.exe 1456 backup.exe 1204 backup.exe 1204 backup.exe 584 backup.exe 584 backup.exe 1204 backup.exe 1204 backup.exe 2012 System Restore.exe 2012 System Restore.exe 1464 backup.exe 1464 backup.exe 1464 backup.exe 1464 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1824 backup.exe 1420 backup.exe 1420 backup.exe 1420 backup.exe 1420 backup.exe 1420 backup.exe 1420 backup.exe 1420 backup.exe 1420 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\update.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\data.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\update.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 1644 backup.exe 1400 backup.exe 828 backup.exe 2032 backup.exe 2000 backup.exe 1772 backup.exe 1488 backup.exe 1456 backup.exe 1340 backup.exe 1552 backup.exe 1204 backup.exe 584 backup.exe 1092 backup.exe 2012 System Restore.exe 1464 backup.exe 1632 backup.exe 1824 backup.exe 1432 backup.exe 1400 backup.exe 2036 backup.exe 2032 backup.exe 908 backup.exe 1692 backup.exe 1448 backup.exe 1712 data.exe 1208 backup.exe 1612 backup.exe 1132 backup.exe 1420 backup.exe 1424 backup.exe 564 backup.exe 1212 backup.exe 524 backup.exe 1536 backup.exe 1620 backup.exe 1104 backup.exe 1396 update.exe 1884 backup.exe 1816 backup.exe 1500 backup.exe 732 backup.exe 1632 data.exe 1680 backup.exe 948 backup.exe 1040 backup.exe 2020 backup.exe 1728 backup.exe 1696 backup.exe 2000 backup.exe 1280 backup.exe 1956 backup.exe 1576 backup.exe 1608 update.exe 1612 backup.exe 1096 backup.exe 1008 System Restore.exe 548 data.exe 684 backup.exe 1736 backup.exe 1812 backup.exe 748 backup.exe 1104 backup.exe 112 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1644 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 28 PID 1660 wrote to memory of 1644 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 28 PID 1660 wrote to memory of 1644 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 28 PID 1660 wrote to memory of 1644 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 28 PID 1660 wrote to memory of 1400 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 29 PID 1660 wrote to memory of 1400 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 29 PID 1660 wrote to memory of 1400 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 29 PID 1660 wrote to memory of 1400 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 29 PID 1660 wrote to memory of 828 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 30 PID 1660 wrote to memory of 828 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 30 PID 1660 wrote to memory of 828 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 30 PID 1660 wrote to memory of 828 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 30 PID 1660 wrote to memory of 2032 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 31 PID 1660 wrote to memory of 2032 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 31 PID 1660 wrote to memory of 2032 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 31 PID 1660 wrote to memory of 2032 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 31 PID 1660 wrote to memory of 2000 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 32 PID 1660 wrote to memory of 2000 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 32 PID 1660 wrote to memory of 2000 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 32 PID 1660 wrote to memory of 2000 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 32 PID 1660 wrote to memory of 1772 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 33 PID 1660 wrote to memory of 1772 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 33 PID 1660 wrote to memory of 1772 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 33 PID 1660 wrote to memory of 1772 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 33 PID 1660 wrote to memory of 1488 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 34 PID 1660 wrote to memory of 1488 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 34 PID 1660 wrote to memory of 1488 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 34 PID 1660 wrote to memory of 1488 1660 fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe 34 PID 1644 wrote to memory of 1456 1644 backup.exe 35 PID 1644 wrote to memory of 1456 1644 backup.exe 35 PID 1644 wrote to memory of 1456 1644 backup.exe 35 PID 1644 wrote to memory of 1456 1644 backup.exe 35 PID 1456 wrote to memory of 1340 1456 backup.exe 36 PID 1456 wrote to memory of 1340 1456 backup.exe 36 PID 1456 wrote to memory of 1340 1456 backup.exe 36 PID 1456 wrote to memory of 1340 1456 backup.exe 36 PID 1340 wrote to memory of 1552 1340 backup.exe 37 PID 1340 wrote to memory of 1552 1340 backup.exe 37 PID 1340 wrote to memory of 1552 1340 backup.exe 37 PID 1340 wrote to memory of 1552 1340 backup.exe 37 PID 1456 wrote to memory of 1204 1456 backup.exe 38 PID 1456 wrote to memory of 1204 1456 backup.exe 38 PID 1456 wrote to memory of 1204 1456 backup.exe 38 PID 1456 wrote to memory of 1204 1456 backup.exe 38 PID 1204 wrote to memory of 584 1204 backup.exe 39 PID 1204 wrote to memory of 584 1204 backup.exe 39 PID 1204 wrote to memory of 584 1204 backup.exe 39 PID 1204 wrote to memory of 584 1204 backup.exe 39 PID 584 wrote to memory of 1092 584 backup.exe 40 PID 584 wrote to memory of 1092 584 backup.exe 40 PID 584 wrote to memory of 1092 584 backup.exe 40 PID 584 wrote to memory of 1092 584 backup.exe 40 PID 1204 wrote to memory of 2012 1204 backup.exe 41 PID 1204 wrote to memory of 2012 1204 backup.exe 41 PID 1204 wrote to memory of 2012 1204 backup.exe 41 PID 1204 wrote to memory of 2012 1204 backup.exe 41 PID 2012 wrote to memory of 1464 2012 System Restore.exe 42 PID 2012 wrote to memory of 1464 2012 System Restore.exe 42 PID 2012 wrote to memory of 1464 2012 System Restore.exe 42 PID 2012 wrote to memory of 1464 2012 System Restore.exe 42 PID 1464 wrote to memory of 1632 1464 backup.exe 43 PID 1464 wrote to memory of 1632 1464 backup.exe 43 PID 1464 wrote to memory of 1632 1464 backup.exe 43 PID 1464 wrote to memory of 1632 1464 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe"C:\Users\Admin\AppData\Local\Temp\fbed3d212f1ccf0ae608d5dc1d0daf4241abd1ff7f102d96e19c8327373779a3.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2651074012\backup.exeC:\Users\Admin\AppData\Local\Temp\2651074012\backup.exe C:\Users\Admin\AppData\Local\Temp\2651074012\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1644 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1456 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1204 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:584 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
-
C:\Program Files\Common Files\System Restore.exe"C:\Program Files\Common Files\System Restore.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1208
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1420 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1424
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:564
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1500
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:732
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1280
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- System policy modification
PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:1396
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1096 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:732
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1140
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Drops file in Program Files directory
PID:852 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1112
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\update.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1340
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1008
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1040
-
-
-
C:\Program Files\Common Files\Services\update.exe"C:\Program Files\Common Files\Services\update.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
C:\Program Files\Common Files\SpeechEngines\data.exe"C:\Program Files\Common Files\SpeechEngines\data.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:548 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1524 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:744 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1040
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:600
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- System policy modification
PID:1532
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1620
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1904
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1816
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1064
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:2000
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1700
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1684
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1980
-
-
-
-
C:\Program Files\DVD Maker\System Restore.exe"C:\Program Files\DVD Maker\System Restore.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1008 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
PID:752
-
-
C:\Program Files\DVD Maker\es-ES\update.exe"C:\Program Files\DVD Maker\es-ES\update.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1600
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2036
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1112
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:564
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:328 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
PID:1180 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1676
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1880
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1792
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:692
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:2012
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:644
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:680
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:536
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:980
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:684 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1504 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- System policy modification
PID:980
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1460
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1700
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1212
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:584 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:1992
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1976
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1912
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1632
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1772
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1920
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1004
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1696
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1940
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:112
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD548be06a2d11d8dfa1dd8e5350e231eea
SHA1fa1b0d80ddecbc0ffc24a1d6282f55ad00c648dd
SHA2566350366a5f573e90efb6ce0e481a999edeeeff4099eb9e19750084dace01d06e
SHA5120f8b55d3c5d4a2483698014fece32a726a5b41066bcdd0dc4911c55fd16ba8baf4e889abfeb951bd909dcce9a32b4257c542a58b49e330c5d1db560fba812810
-
Filesize
72KB
MD56306d4e33f6dd5ec60a8ea9b4f1e5722
SHA164348f3a6cbb2dd82dbb2bce29669ea796cd612e
SHA25627edad5c7e95973c5135f2bccd8d801c43032c375f4e7d7ad136ca6c22022422
SHA512370d6888f90f03d32ed01da122b6eade7336827e544ae9fb98432bbf91b1565c5e493b64004e80bf4c3c2901a51133dd7a08c4aaca08e012e0f0da1c1baf3775
-
Filesize
72KB
MD56306d4e33f6dd5ec60a8ea9b4f1e5722
SHA164348f3a6cbb2dd82dbb2bce29669ea796cd612e
SHA25627edad5c7e95973c5135f2bccd8d801c43032c375f4e7d7ad136ca6c22022422
SHA512370d6888f90f03d32ed01da122b6eade7336827e544ae9fb98432bbf91b1565c5e493b64004e80bf4c3c2901a51133dd7a08c4aaca08e012e0f0da1c1baf3775
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD593aeb68cc6d4d0db104fbe07340656bb
SHA10f291abcce9ed1911f0d44829131107850aa05ca
SHA256402524cd5dae57855c3e90321690e9dbd7bcda3d36cddfe48a6ea65ba0f919df
SHA5120e921e9c0dddd7d86a8473ec43f4fa216a8639dbbffd8b246825e5d1392a340e37c2288741da39d50879e837924b67cb47a24e3dbd2da23c874b32f97bff089f
-
Filesize
72KB
MD593aeb68cc6d4d0db104fbe07340656bb
SHA10f291abcce9ed1911f0d44829131107850aa05ca
SHA256402524cd5dae57855c3e90321690e9dbd7bcda3d36cddfe48a6ea65ba0f919df
SHA5120e921e9c0dddd7d86a8473ec43f4fa216a8639dbbffd8b246825e5d1392a340e37c2288741da39d50879e837924b67cb47a24e3dbd2da23c874b32f97bff089f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD5b779d2c1120f1f725d13996aae0e9216
SHA1fd5afbd5051dd69ef152f306789da399fcecf00a
SHA2562e7d6b7ecf6da6cf90e71921fd392226d5c885b5728a1653d3f47cf0ba3ecf8a
SHA512f170d997233dc4b46fee53b82ce07d0e67ba9f382cf60c545d9ec6676e8b1c21758462ce4036e597caf7f6587273333ee5566c6b4d831433b318d6f19589ab75
-
Filesize
72KB
MD5b779d2c1120f1f725d13996aae0e9216
SHA1fd5afbd5051dd69ef152f306789da399fcecf00a
SHA2562e7d6b7ecf6da6cf90e71921fd392226d5c885b5728a1653d3f47cf0ba3ecf8a
SHA512f170d997233dc4b46fee53b82ce07d0e67ba9f382cf60c545d9ec6676e8b1c21758462ce4036e597caf7f6587273333ee5566c6b4d831433b318d6f19589ab75
-
Filesize
72KB
MD548be06a2d11d8dfa1dd8e5350e231eea
SHA1fa1b0d80ddecbc0ffc24a1d6282f55ad00c648dd
SHA2566350366a5f573e90efb6ce0e481a999edeeeff4099eb9e19750084dace01d06e
SHA5120f8b55d3c5d4a2483698014fece32a726a5b41066bcdd0dc4911c55fd16ba8baf4e889abfeb951bd909dcce9a32b4257c542a58b49e330c5d1db560fba812810
-
Filesize
72KB
MD548be06a2d11d8dfa1dd8e5350e231eea
SHA1fa1b0d80ddecbc0ffc24a1d6282f55ad00c648dd
SHA2566350366a5f573e90efb6ce0e481a999edeeeff4099eb9e19750084dace01d06e
SHA5120f8b55d3c5d4a2483698014fece32a726a5b41066bcdd0dc4911c55fd16ba8baf4e889abfeb951bd909dcce9a32b4257c542a58b49e330c5d1db560fba812810
-
Filesize
72KB
MD56306d4e33f6dd5ec60a8ea9b4f1e5722
SHA164348f3a6cbb2dd82dbb2bce29669ea796cd612e
SHA25627edad5c7e95973c5135f2bccd8d801c43032c375f4e7d7ad136ca6c22022422
SHA512370d6888f90f03d32ed01da122b6eade7336827e544ae9fb98432bbf91b1565c5e493b64004e80bf4c3c2901a51133dd7a08c4aaca08e012e0f0da1c1baf3775
-
Filesize
72KB
MD56306d4e33f6dd5ec60a8ea9b4f1e5722
SHA164348f3a6cbb2dd82dbb2bce29669ea796cd612e
SHA25627edad5c7e95973c5135f2bccd8d801c43032c375f4e7d7ad136ca6c22022422
SHA512370d6888f90f03d32ed01da122b6eade7336827e544ae9fb98432bbf91b1565c5e493b64004e80bf4c3c2901a51133dd7a08c4aaca08e012e0f0da1c1baf3775
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5797982fd52f614dcff8c62648ab4c578
SHA186189b20a584ca822eb82b7b4b35229458db2bc3
SHA256c1056b6272274e4457e25401c7f79ba0c9dd64b0eecb19945e02531f98ecb3e9
SHA51204f71a47b69f1341f24cf2152851aa726052c0502b182c2d3f8192e217b5b3ee992f3861e8a5c799fe2e57511314058951927bbc1ca2d7118ff4adc3edae9a70
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5ecdfc887b629d20fb1808ee88a6efe96
SHA1c773333e0fc9f749e032abea539e89442de0b793
SHA2560f5cee2655339a85d2502dc5830845913a8ee095021e46115e3419b46ef3f067
SHA51281de99d0726f9cd474518e51913667f9041d87d6b3a51ed5a97e315772c1ea6f73923eb3d9f28f080b8cc41423f51df9a95e2429684ee470e8649ec51ca522a1
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5b8cff911058d6d69cd38c7808b0aa79b
SHA1ab19cbba0316cb7050898ea8fa078ca4eccb4b1d
SHA2565b84095c402d7d86ab0f1afd4758e186fc099d9ab6eb130b414695100b784366
SHA512dd59a9df39236fad23b2fc9709d9b45c93ca90cb94d92f188809e7537fa01b986e418114e3ebd8ccce21388f5b0c232b16eb62e6133ed49ba78d1ef7421d5f95
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD5d8db060fa75a080c9692dd63fa035061
SHA1671a807c6f9933ee972f5289d86fccc199d90a2a
SHA2565e1004e3ea90fceb93f983f2d9cfcb978508c9cae6f0996edca35c62aef6c3b7
SHA5121911e2a99b43dca05ccd751a5a277cb60a194cc0af318a3b733576a8fca514518e07b282d795aacbd3fc227132417ba8c7570558b837f0459b9edad952a27e68
-
Filesize
72KB
MD593aeb68cc6d4d0db104fbe07340656bb
SHA10f291abcce9ed1911f0d44829131107850aa05ca
SHA256402524cd5dae57855c3e90321690e9dbd7bcda3d36cddfe48a6ea65ba0f919df
SHA5120e921e9c0dddd7d86a8473ec43f4fa216a8639dbbffd8b246825e5d1392a340e37c2288741da39d50879e837924b67cb47a24e3dbd2da23c874b32f97bff089f
-
Filesize
72KB
MD593aeb68cc6d4d0db104fbe07340656bb
SHA10f291abcce9ed1911f0d44829131107850aa05ca
SHA256402524cd5dae57855c3e90321690e9dbd7bcda3d36cddfe48a6ea65ba0f919df
SHA5120e921e9c0dddd7d86a8473ec43f4fa216a8639dbbffd8b246825e5d1392a340e37c2288741da39d50879e837924b67cb47a24e3dbd2da23c874b32f97bff089f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f
-
Filesize
72KB
MD571762c4d859b2d14cc587a516579da55
SHA13e3093376abb8651301ed4f63c0b9a7e01740074
SHA25639774e3487a42f7f680480e73e5b64a9ee22781a32968841f7e7e1a711e9c3c1
SHA51241a6f38918ce7d09081f65320fd2298d23cf251796a841e1498a3e6656d666993037d403f78eeee387acc2e7fa9e03bf25c9222f9e7b7d360949c42f0497140f