Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe
Resource
win10v2004-20220812-en
General
-
Target
f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe
-
Size
72KB
-
MD5
09af1f83b4fd8208c1432bdce05d939b
-
SHA1
4a159d62986de3d5ed2ca60fc23995eb316a7f7f
-
SHA256
f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe
-
SHA512
dbfdc1864146071b07df8ff4b8bfcbb7cfb01c7dabc1ddd37ff47f55f0dc2f77888c25a2d89b05067d31edefd3d13c7586d79627952ba08653d296d4bf31b2af
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2L:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP/
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1780 backup.exe 912 backup.exe 1736 backup.exe 1184 backup.exe 2036 backup.exe 836 backup.exe 552 backup.exe 688 backup.exe 1088 backup.exe 1636 backup.exe 1924 backup.exe 1196 System Restore.exe 1216 backup.exe 1192 backup.exe 980 backup.exe 1764 backup.exe 1916 backup.exe 1952 backup.exe 856 backup.exe 1356 backup.exe 1180 backup.exe 1508 backup.exe 2036 backup.exe 1468 backup.exe 1028 update.exe 1896 backup.exe 1936 backup.exe 1836 backup.exe 1520 System Restore.exe 1456 backup.exe 2008 backup.exe 1636 backup.exe 1504 backup.exe 844 backup.exe 840 backup.exe 432 backup.exe 1440 backup.exe 2012 backup.exe 1664 backup.exe 1484 backup.exe 1668 backup.exe 1840 System Restore.exe 1396 update.exe 1952 backup.exe 956 backup.exe 1076 System Restore.exe 1756 backup.exe 524 data.exe 1220 backup.exe 836 backup.exe 1016 backup.exe 1028 backup.exe 1896 backup.exe 1936 backup.exe 1324 backup.exe 1084 backup.exe 596 backup.exe 1088 data.exe 1000 backup.exe 1036 backup.exe 1684 backup.exe 1316 backup.exe 1792 backup.exe 472 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 688 backup.exe 688 backup.exe 1088 backup.exe 1088 backup.exe 688 backup.exe 688 backup.exe 1924 backup.exe 1924 backup.exe 1196 System Restore.exe 1196 System Restore.exe 1924 backup.exe 1924 backup.exe 1192 backup.exe 1192 backup.exe 980 backup.exe 980 backup.exe 980 backup.exe 980 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1028 update.exe 1028 update.exe 1028 update.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1916 backup.exe 1520 System Restore.exe 1520 System Restore.exe 1520 System Restore.exe 1520 System Restore.exe 1520 System Restore.exe 1520 System Restore.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe System Restore.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\update.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe System Restore.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System Restore.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\System Restore.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\System Restore.exe backup.exe File opened for modification C:\Windows\addins\backup.exe System Restore.exe File opened for modification C:\Windows\AppCompat\backup.exe System Restore.exe File opened for modification C:\Windows\AppPatch\backup.exe System Restore.exe File opened for modification C:\Windows\assembly\backup.exe System Restore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 1780 backup.exe 912 backup.exe 1736 backup.exe 1184 backup.exe 2036 backup.exe 836 backup.exe 552 backup.exe 688 backup.exe 1088 backup.exe 1636 backup.exe 1924 backup.exe 1196 System Restore.exe 1216 backup.exe 1192 backup.exe 980 backup.exe 1764 backup.exe 1916 backup.exe 1952 backup.exe 856 backup.exe 1356 backup.exe 1180 backup.exe 1508 backup.exe 2036 backup.exe 1468 backup.exe 1028 update.exe 1896 backup.exe 1936 backup.exe 1836 backup.exe 1520 System Restore.exe 1456 backup.exe 2008 backup.exe 1636 backup.exe 1504 backup.exe 844 backup.exe 840 backup.exe 432 backup.exe 1440 backup.exe 2012 backup.exe 1664 backup.exe 1484 backup.exe 1668 backup.exe 1840 System Restore.exe 1396 update.exe 1952 backup.exe 956 backup.exe 1076 System Restore.exe 1756 backup.exe 524 data.exe 1220 backup.exe 836 backup.exe 1016 backup.exe 1028 backup.exe 1896 backup.exe 1936 backup.exe 1324 backup.exe 1084 backup.exe 596 backup.exe 1088 data.exe 1000 backup.exe 1036 backup.exe 1684 backup.exe 1316 backup.exe 1792 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1780 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 28 PID 1492 wrote to memory of 1780 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 28 PID 1492 wrote to memory of 1780 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 28 PID 1492 wrote to memory of 1780 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 28 PID 1492 wrote to memory of 912 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 29 PID 1492 wrote to memory of 912 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 29 PID 1492 wrote to memory of 912 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 29 PID 1492 wrote to memory of 912 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 29 PID 1492 wrote to memory of 1736 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 30 PID 1492 wrote to memory of 1736 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 30 PID 1492 wrote to memory of 1736 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 30 PID 1492 wrote to memory of 1736 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 30 PID 1492 wrote to memory of 1184 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 31 PID 1492 wrote to memory of 1184 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 31 PID 1492 wrote to memory of 1184 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 31 PID 1492 wrote to memory of 1184 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 31 PID 1492 wrote to memory of 2036 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 32 PID 1492 wrote to memory of 2036 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 32 PID 1492 wrote to memory of 2036 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 32 PID 1492 wrote to memory of 2036 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 32 PID 1492 wrote to memory of 836 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 33 PID 1492 wrote to memory of 836 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 33 PID 1492 wrote to memory of 836 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 33 PID 1492 wrote to memory of 836 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 33 PID 1492 wrote to memory of 552 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 34 PID 1492 wrote to memory of 552 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 34 PID 1492 wrote to memory of 552 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 34 PID 1492 wrote to memory of 552 1492 f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe 34 PID 1780 wrote to memory of 688 1780 backup.exe 35 PID 1780 wrote to memory of 688 1780 backup.exe 35 PID 1780 wrote to memory of 688 1780 backup.exe 35 PID 1780 wrote to memory of 688 1780 backup.exe 35 PID 688 wrote to memory of 1088 688 backup.exe 36 PID 688 wrote to memory of 1088 688 backup.exe 36 PID 688 wrote to memory of 1088 688 backup.exe 36 PID 688 wrote to memory of 1088 688 backup.exe 36 PID 1088 wrote to memory of 1636 1088 backup.exe 37 PID 1088 wrote to memory of 1636 1088 backup.exe 37 PID 1088 wrote to memory of 1636 1088 backup.exe 37 PID 1088 wrote to memory of 1636 1088 backup.exe 37 PID 688 wrote to memory of 1924 688 backup.exe 38 PID 688 wrote to memory of 1924 688 backup.exe 38 PID 688 wrote to memory of 1924 688 backup.exe 38 PID 688 wrote to memory of 1924 688 backup.exe 38 PID 1924 wrote to memory of 1196 1924 backup.exe 39 PID 1924 wrote to memory of 1196 1924 backup.exe 39 PID 1924 wrote to memory of 1196 1924 backup.exe 39 PID 1924 wrote to memory of 1196 1924 backup.exe 39 PID 1196 wrote to memory of 1216 1196 System Restore.exe 40 PID 1196 wrote to memory of 1216 1196 System Restore.exe 40 PID 1196 wrote to memory of 1216 1196 System Restore.exe 40 PID 1196 wrote to memory of 1216 1196 System Restore.exe 40 PID 1924 wrote to memory of 1192 1924 backup.exe 41 PID 1924 wrote to memory of 1192 1924 backup.exe 41 PID 1924 wrote to memory of 1192 1924 backup.exe 41 PID 1924 wrote to memory of 1192 1924 backup.exe 41 PID 1192 wrote to memory of 980 1192 backup.exe 42 PID 1192 wrote to memory of 980 1192 backup.exe 42 PID 1192 wrote to memory of 980 1192 backup.exe 42 PID 1192 wrote to memory of 980 1192 backup.exe 42 PID 980 wrote to memory of 1764 980 backup.exe 43 PID 980 wrote to memory of 1764 980 backup.exe 43 PID 980 wrote to memory of 1764 980 backup.exe 43 PID 980 wrote to memory of 1764 980 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe"C:\Users\Admin\AppData\Local\Temp\f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1746280505\backup.exeC:\Users\Admin\AppData\Local\Temp\1746280505\backup.exe C:\Users\Admin\AppData\Local\Temp\1746280505\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1780 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:688 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1636
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files\7-Zip\System Restore.exe"C:\Program Files\7-Zip\System Restore.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1196 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1216
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1916 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1356
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1180
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1520 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1636
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1504
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2012
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1664
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1076
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1792
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Disables RegEdit via registry modification
PID:1440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Disables RegEdit via registry modification
PID:1264
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1588 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:564
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Disables RegEdit via registry modification
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:960
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Disables RegEdit via registry modification
PID:564
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1636
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:1032
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Disables RegEdit via registry modification
PID:592
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Disables RegEdit via registry modification
PID:796
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
PID:1488 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1836
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:872
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:1000
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Disables RegEdit via registry modification
PID:1776 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:912
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:2148
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1840
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2164
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1572
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Drops file in Program Files directory
PID:1740 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1676
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1664 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1220 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1196
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1900
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1744
-
-
C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe"C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1740
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1588
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1268
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1952
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:848
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1708
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2072
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2476
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:1712 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
PID:316
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
PID:840
-
-
C:\Program Files\DVD Maker\es-ES\data.exe"C:\Program Files\DVD Maker\es-ES\data.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:876
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1624
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
PID:1440
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- System policy modification
PID:872
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- System policy modification
PID:300 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:556 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1748
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:432
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1376
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1712
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1684
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:2120
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:2452
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
PID:1292 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1140 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1404 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1076 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
PID:300
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1764
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
PID:1504
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:916
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1296
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵PID:1508
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1296
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Drops file in Program Files directory
PID:2012 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1972
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:840
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1972
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1292
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2104
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2432
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1128
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1136
-
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵PID:1236
-
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵PID:2096
-
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\6⤵PID:2484
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1636
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2128
-
-
-
C:\Program Files (x86)\data.exe"C:\Program Files (x86)\data.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1088 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1316 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
- System policy modification
PID:472
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1516 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- System policy modification
PID:1972
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1376
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1184
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1936 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
PID:928
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
PID:568
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Drops file in Program Files directory
PID:1932 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:592
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Disables RegEdit via registry modification
PID:1552
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Drops file in Program Files directory
- System policy modification
PID:876 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
PID:1136 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
PID:1676
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:700
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:1036
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1400
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:2064
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:880
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1140
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2172
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1040 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1028 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1584
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- System policy modification
PID:1484
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- System policy modification
PID:1376 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1468
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Modifies visibility of file extensions in Explorer
PID:1268 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- Drops file in Program Files directory
PID:1620 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵
- Disables RegEdit via registry modification
PID:840
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1796
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:964
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵PID:836
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1984 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:1000
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1180 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1708 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:268
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2012 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:528 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Disables RegEdit via registry modification
PID:780 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵
- Modifies visibility of file extensions in Explorer
PID:1028
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- System policy modification
PID:1972
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\update.exe"C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1764
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- Modifies visibility of file extensions in Explorer
PID:1504 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵PID:1360
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1932
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1764
-
C:\Program Files (x86)\Common Files\microsoft shared\DAO\update.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\7⤵PID:2008
-
-
C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\7⤵PID:2088
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\7⤵PID:2440
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:316
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2112
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2492
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1016 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:848
-
-
C:\Program Files (x86)\Google\Policies\update.exe"C:\Program Files (x86)\Google\Policies\update.exe" C:\Program Files (x86)\Google\Policies\6⤵
- Disables RegEdit via registry modification
PID:1964
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
- Modifies visibility of file extensions in Explorer
PID:528
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1504
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1720
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:2508
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:320
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:908
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2156
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:956 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1652 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
PID:700
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1480
-
-
C:\Users\Admin\Documents\data.exeC:\Users\Admin\Documents\data.exe C:\Users\Admin\Documents\6⤵
- Disables RegEdit via registry modification
PID:1916
-
-
C:\Users\Admin\Downloads\System Restore.exe"C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\6⤵PID:1744
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:472
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:928
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Disables RegEdit via registry modification
PID:1968
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:1952
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- Disables RegEdit via registry modification
PID:1448
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:536
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵PID:1572
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:300
-
-
-
C:\Windows\System Restore.exe"C:\Windows\System Restore.exe" C:\Windows\4⤵
- Drops file in Windows directory
PID:524 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:1648
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:916
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:872
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1124
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:1040
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:2080
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵PID:2460
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD5f2aa8c9e4d36b1a4b901cf6516536d7b
SHA1bf7b44ea3a988b1d14ad815cc4efb10226fbfdd8
SHA2567d514f23a9f18cf2fdbbebdd87aa312ddcde45b1a16450cd6b1bc31a6d91fdcb
SHA512dab2e84b2334c5dce8c6cc36ec21b4733743c739ba7e6a772dd740eb3ce3cb31447c248c25ada326fa53011a535e6bb1d94b946b00f2ecfe1652718e55d0f939
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD59e44e482e6cd5a829738ed6ef0833af8
SHA1ea2eb54360226f6d1c36b51e839dfb0e0164bf1a
SHA256e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331
SHA512783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914
-
Filesize
72KB
MD59e44e482e6cd5a829738ed6ef0833af8
SHA1ea2eb54360226f6d1c36b51e839dfb0e0164bf1a
SHA256e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331
SHA512783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD530a8ac1c8ca66633d27725653f757ef8
SHA1c031a3a5fd5ac5ef0d4860b0ad71461850290a8a
SHA25620336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4
SHA512288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720
-
Filesize
72KB
MD530a8ac1c8ca66633d27725653f757ef8
SHA1c031a3a5fd5ac5ef0d4860b0ad71461850290a8a
SHA25620336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4
SHA512288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD53d8bc47e64283ffbd405ef7de31bb6e8
SHA1b9efa91ce21a0af1d60dd81fe97b100937a45279
SHA256b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765
SHA51252d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8
-
Filesize
72KB
MD53d8bc47e64283ffbd405ef7de31bb6e8
SHA1b9efa91ce21a0af1d60dd81fe97b100937a45279
SHA256b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765
SHA51252d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD59e75479ed82be2349e692e8e51d97a41
SHA12c2f34d2135c88863c30ee23358d4e99f9672673
SHA25627008a457950afbb928ae77643187c67ca41ba7e714f21b4c6c09eafa3d66bfb
SHA512c639918554d0d95069b51ac8e98f425d18ba4b5ec631a581d0609432f5156543f2ac4cb73e720f629011d329901b23c970a07dbf15978bc4c67253f3270cd6fe
-
Filesize
72KB
MD59e75479ed82be2349e692e8e51d97a41
SHA12c2f34d2135c88863c30ee23358d4e99f9672673
SHA25627008a457950afbb928ae77643187c67ca41ba7e714f21b4c6c09eafa3d66bfb
SHA512c639918554d0d95069b51ac8e98f425d18ba4b5ec631a581d0609432f5156543f2ac4cb73e720f629011d329901b23c970a07dbf15978bc4c67253f3270cd6fe
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD5f2aa8c9e4d36b1a4b901cf6516536d7b
SHA1bf7b44ea3a988b1d14ad815cc4efb10226fbfdd8
SHA2567d514f23a9f18cf2fdbbebdd87aa312ddcde45b1a16450cd6b1bc31a6d91fdcb
SHA512dab2e84b2334c5dce8c6cc36ec21b4733743c739ba7e6a772dd740eb3ce3cb31447c248c25ada326fa53011a535e6bb1d94b946b00f2ecfe1652718e55d0f939
-
Filesize
72KB
MD5f2aa8c9e4d36b1a4b901cf6516536d7b
SHA1bf7b44ea3a988b1d14ad815cc4efb10226fbfdd8
SHA2567d514f23a9f18cf2fdbbebdd87aa312ddcde45b1a16450cd6b1bc31a6d91fdcb
SHA512dab2e84b2334c5dce8c6cc36ec21b4733743c739ba7e6a772dd740eb3ce3cb31447c248c25ada326fa53011a535e6bb1d94b946b00f2ecfe1652718e55d0f939
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD56203aa06584a8b0b18d4e2708a77de5a
SHA14318b75c4c33aa3fca1d9186bce1e537daca82fa
SHA256d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02
SHA5126146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD59e44e482e6cd5a829738ed6ef0833af8
SHA1ea2eb54360226f6d1c36b51e839dfb0e0164bf1a
SHA256e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331
SHA512783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914
-
Filesize
72KB
MD59e44e482e6cd5a829738ed6ef0833af8
SHA1ea2eb54360226f6d1c36b51e839dfb0e0164bf1a
SHA256e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331
SHA512783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD5fcf6885968b135564e44dc353a335dfe
SHA1af38fa1b6bea4b4d8bf21101c963cab53bff2762
SHA256d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c
SHA51209a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD5145e7fce208d824fe1c0b382a3542c4a
SHA160104a30d18d8cf71bae0cc9628686c7a54ac0c9
SHA256ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d
SHA5126315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b
-
Filesize
72KB
MD530a8ac1c8ca66633d27725653f757ef8
SHA1c031a3a5fd5ac5ef0d4860b0ad71461850290a8a
SHA25620336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4
SHA512288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720
-
Filesize
72KB
MD530a8ac1c8ca66633d27725653f757ef8
SHA1c031a3a5fd5ac5ef0d4860b0ad71461850290a8a
SHA25620336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4
SHA512288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD5ec207e3f86d2883c4b508ee80148cd1c
SHA11e77013a0b4d2d1c919a1fbc801c936f658f9509
SHA256d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b
SHA512ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6
-
Filesize
72KB
MD53d8bc47e64283ffbd405ef7de31bb6e8
SHA1b9efa91ce21a0af1d60dd81fe97b100937a45279
SHA256b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765
SHA51252d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8
-
Filesize
72KB
MD53d8bc47e64283ffbd405ef7de31bb6e8
SHA1b9efa91ce21a0af1d60dd81fe97b100937a45279
SHA256b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765
SHA51252d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d
-
Filesize
72KB
MD5d13c74050558b1d1c90609dfbbe18dbf
SHA1898b2574ac8b182ac46efd4c23ecc708102f0495
SHA256f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46
SHA5129fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d