Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe
Resource
win10v2004-20221111-en
General
-
Target
84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe
-
Size
72KB
-
MD5
01599a637f4d06af5430fe196c017fd8
-
SHA1
22c1acdb8457f08c7fe228eea54da097f2b0d036
-
SHA256
84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e
-
SHA512
f11e0da71c52a1e4b8e24d149eacf8f9897f9cb1b5f272a672e7869c89b231c84de300f8de4a759f50cf68782be2bb815a1673dbdb717131e522ea54b134915b
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2S:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPG
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1960 backup.exe 1204 data.exe 520 backup.exe 580 backup.exe 1496 backup.exe 1800 backup.exe 1792 backup.exe 1152 backup.exe 1536 backup.exe 2000 backup.exe 1956 data.exe 1632 backup.exe 1056 backup.exe 1908 backup.exe 1628 backup.exe 1464 update.exe 2012 backup.exe 1680 backup.exe 1880 backup.exe 1204 backup.exe 1292 backup.exe 1672 backup.exe 1752 backup.exe 336 backup.exe 1592 backup.exe 1800 backup.exe 1516 backup.exe 388 System Restore.exe 1040 backup.exe 1920 backup.exe 1912 backup.exe 1740 backup.exe 964 backup.exe 860 update.exe 1648 backup.exe 1704 backup.exe 1056 backup.exe 1980 backup.exe 1712 backup.exe 1384 backup.exe 1660 System Restore.exe 1700 backup.exe 1688 backup.exe 584 backup.exe 1676 backup.exe 1352 backup.exe 2028 backup.exe 456 backup.exe 1720 backup.exe 1080 backup.exe 1316 backup.exe 1276 data.exe 572 backup.exe 1528 backup.exe 1144 backup.exe 1468 backup.exe 1380 backup.exe 1192 backup.exe 2004 backup.exe 1296 data.exe 1604 System Restore.exe 1564 backup.exe 1520 backup.exe 812 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 1152 backup.exe 1152 backup.exe 1536 backup.exe 1536 backup.exe 1152 backup.exe 1152 backup.exe 1956 data.exe 1956 data.exe 1632 backup.exe 1632 backup.exe 1956 data.exe 1956 data.exe 1908 backup.exe 1908 backup.exe 1628 backup.exe 1464 update.exe 1464 update.exe 1464 update.exe 1628 backup.exe 1628 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 2012 backup.exe 1040 backup.exe 1040 backup.exe 1040 backup.exe 1040 backup.exe 1152 backup.exe 1040 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe data.exe File opened for modification C:\Program Files\Common Files\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 1960 backup.exe 1204 data.exe 520 backup.exe 580 backup.exe 1496 backup.exe 1800 backup.exe 1792 backup.exe 1152 backup.exe 1536 backup.exe 2000 backup.exe 1956 data.exe 1632 backup.exe 1056 backup.exe 1908 backup.exe 1628 backup.exe 1464 update.exe 2012 backup.exe 1680 backup.exe 1880 backup.exe 1204 backup.exe 1292 backup.exe 1672 backup.exe 1752 backup.exe 336 backup.exe 1592 backup.exe 1800 backup.exe 1516 backup.exe 388 System Restore.exe 1040 backup.exe 1920 backup.exe 1912 backup.exe 1740 backup.exe 964 backup.exe 1648 backup.exe 1704 backup.exe 860 update.exe 1056 backup.exe 1980 backup.exe 1712 backup.exe 1660 System Restore.exe 1384 backup.exe 1700 backup.exe 1688 backup.exe 1676 backup.exe 584 backup.exe 1352 backup.exe 2028 backup.exe 456 backup.exe 1720 backup.exe 1080 backup.exe 1316 backup.exe 1276 data.exe 572 backup.exe 1528 backup.exe 1468 backup.exe 1144 backup.exe 1192 backup.exe 1380 backup.exe 2004 backup.exe 1604 System Restore.exe 1296 data.exe 1564 backup.exe 1520 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 988 wrote to memory of 1960 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 27 PID 988 wrote to memory of 1960 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 27 PID 988 wrote to memory of 1960 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 27 PID 988 wrote to memory of 1960 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 27 PID 988 wrote to memory of 1204 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 28 PID 988 wrote to memory of 1204 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 28 PID 988 wrote to memory of 1204 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 28 PID 988 wrote to memory of 1204 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 28 PID 988 wrote to memory of 520 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 29 PID 988 wrote to memory of 520 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 29 PID 988 wrote to memory of 520 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 29 PID 988 wrote to memory of 520 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 29 PID 988 wrote to memory of 580 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 30 PID 988 wrote to memory of 580 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 30 PID 988 wrote to memory of 580 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 30 PID 988 wrote to memory of 580 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 30 PID 988 wrote to memory of 1496 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 31 PID 988 wrote to memory of 1496 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 31 PID 988 wrote to memory of 1496 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 31 PID 988 wrote to memory of 1496 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 31 PID 988 wrote to memory of 1800 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 32 PID 988 wrote to memory of 1800 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 32 PID 988 wrote to memory of 1800 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 32 PID 988 wrote to memory of 1800 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 32 PID 988 wrote to memory of 1792 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 33 PID 988 wrote to memory of 1792 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 33 PID 988 wrote to memory of 1792 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 33 PID 988 wrote to memory of 1792 988 84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe 33 PID 1960 wrote to memory of 1152 1960 backup.exe 34 PID 1960 wrote to memory of 1152 1960 backup.exe 34 PID 1960 wrote to memory of 1152 1960 backup.exe 34 PID 1960 wrote to memory of 1152 1960 backup.exe 34 PID 1152 wrote to memory of 1536 1152 backup.exe 35 PID 1152 wrote to memory of 1536 1152 backup.exe 35 PID 1152 wrote to memory of 1536 1152 backup.exe 35 PID 1152 wrote to memory of 1536 1152 backup.exe 35 PID 1536 wrote to memory of 2000 1536 backup.exe 36 PID 1536 wrote to memory of 2000 1536 backup.exe 36 PID 1536 wrote to memory of 2000 1536 backup.exe 36 PID 1536 wrote to memory of 2000 1536 backup.exe 36 PID 1152 wrote to memory of 1956 1152 backup.exe 37 PID 1152 wrote to memory of 1956 1152 backup.exe 37 PID 1152 wrote to memory of 1956 1152 backup.exe 37 PID 1152 wrote to memory of 1956 1152 backup.exe 37 PID 1956 wrote to memory of 1632 1956 data.exe 38 PID 1956 wrote to memory of 1632 1956 data.exe 38 PID 1956 wrote to memory of 1632 1956 data.exe 38 PID 1956 wrote to memory of 1632 1956 data.exe 38 PID 1632 wrote to memory of 1056 1632 backup.exe 39 PID 1632 wrote to memory of 1056 1632 backup.exe 39 PID 1632 wrote to memory of 1056 1632 backup.exe 39 PID 1632 wrote to memory of 1056 1632 backup.exe 39 PID 1956 wrote to memory of 1908 1956 data.exe 40 PID 1956 wrote to memory of 1908 1956 data.exe 40 PID 1956 wrote to memory of 1908 1956 data.exe 40 PID 1956 wrote to memory of 1908 1956 data.exe 40 PID 1908 wrote to memory of 1628 1908 backup.exe 41 PID 1908 wrote to memory of 1628 1908 backup.exe 41 PID 1908 wrote to memory of 1628 1908 backup.exe 41 PID 1908 wrote to memory of 1628 1908 backup.exe 41 PID 1628 wrote to memory of 1464 1628 backup.exe 42 PID 1628 wrote to memory of 1464 1628 backup.exe 42 PID 1628 wrote to memory of 1464 1628 backup.exe 42 PID 1628 wrote to memory of 1464 1628 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe"C:\Users\Admin\AppData\Local\Temp\84a98c4a7fe88d0ecdd5086c9a18b9de7df412a2232c4b6c2525aa06e6de756e.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2387630252\backup.exeC:\Users\Admin\AppData\Local\Temp\2387630252\backup.exe C:\Users\Admin\AppData\Local\Temp\2387630252\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1152 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
-
C:\Program Files\data.exe"C:\Program Files\data.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1632 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1056
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1908 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628 -
C:\Program Files\Common Files\Microsoft Shared\Filters\update.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\update.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1292
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:388
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1040 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1296
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:364
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- System policy modification
PID:1916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- System policy modification
PID:740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- System policy modification
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Disables RegEdit via registry modification
PID:1884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵PID:812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵PID:2156
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵PID:2336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵PID:2416
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵PID:2556
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1352 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1144
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:1052
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:820
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1828
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
PID:744 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1712
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1080
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
PID:1828
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:820
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1184
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2164
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:584 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1192 -
C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe"C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:884
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
PID:1660
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1552
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1356
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1316
-
-
-
C:\Program Files\Common Files\System\de-DE\System Restore.exe"C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1920
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1836
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1124
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Disables RegEdit via registry modification
PID:336
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:456
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:112
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1592
-
-
C:\Program Files\Common Files\System\Ole DB\System Restore.exe"C:\Program Files\Common Files\System\Ole DB\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1984
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1056
-
-
C:\Program Files\DVD Maker\en-US\System Restore.exe"C:\Program Files\DVD Maker\en-US\System Restore.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:812
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1896 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1092 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1632
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1224
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:992
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Disables RegEdit via registry modification
PID:1260
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2020
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1496
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:972
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1072
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1908
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:2172
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:2312
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:2448
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:2580
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1924 -
C:\Program Files\Google\Chrome\data.exe"C:\Program Files\Google\Chrome\data.exe" C:\Program Files\Google\Chrome\6⤵
- Disables RegEdit via registry modification
PID:1640 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Drops file in Program Files directory
PID:1904 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:1964
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- System policy modification
PID:1668
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵PID:2464
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\System Restore.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\System Restore.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1924
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1952
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1764
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:2276
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:2392
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1708
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2148
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2348
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2480
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2588
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:964 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1384 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Drops file in Program Files directory
PID:1072 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
PID:1712
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
PID:320
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1324 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- System policy modification
PID:1880
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1408
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:268 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1576 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
PID:1544
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:1908
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:1476
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:2216
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:1324
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵PID:2400
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1920
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:2524
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:364
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1680
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1112 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2008 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1408
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
PID:1468
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1740
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1660
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵PID:1632
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1200
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1196
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1260
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1912 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1048 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:432
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1880
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Modifies visibility of file extensions in Explorer
PID:320 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵PID:1620
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵PID:2532
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1732
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1604
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:816
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2044
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2140
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2296
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2472
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1068
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1316
-
-
C:\Program Files (x86)\Microsoft Analysis Services\data.exe"C:\Program Files (x86)\Microsoft Analysis Services\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:464
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2572
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
PID:616 -
C:\Users\Admin\data.exeC:\Users\Admin\data.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:840 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
PID:676
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:940
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1356
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1832
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1120
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:1916
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2180
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:2284
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:2408
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:2564
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1564
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1040
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1712
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1836
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:844
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2200
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2328
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:2440
-
-
C:\Windows\Cursors\System Restore.exe"C:\Windows\Cursors\System Restore.exe" C:\Windows\Cursors\5⤵PID:2596
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:520
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD59c6279969d70ec18e4b183d8cc0fb150
SHA1a6defd4ce76271e03fa26996e1fc4a7b7ab158d6
SHA25671e159dc63f3f330725cbc33969449cb822944063bb1f8b366717389d6f9ddb9
SHA5128fb8c36609d90f04056dd3bdb16461169e88c295a52bae48c6da5efdf0bc6441c7b9b58ed20cef8c352b9ba29cb3e18b56cd9ab2d2a57794f07251407bb6b32a
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD58bf80abbd98f0ee3fb22a9fc0ce4be17
SHA19018da374b03695362b1faa9e6ba1952f8846ce4
SHA256e09165b3f4f512e3b69159449e87d3e21305f3a5934ea6d1df304de183889e15
SHA512f4dff73709e495f0a940a9e5d9e3573a010a7b0a282b72743d019403a86974a3b90fb5b9a9741c2b37df2ecd1b47b3b6bfdbda2ea68d11f9ab3da82c35576610
-
Filesize
72KB
MD58bf80abbd98f0ee3fb22a9fc0ce4be17
SHA19018da374b03695362b1faa9e6ba1952f8846ce4
SHA256e09165b3f4f512e3b69159449e87d3e21305f3a5934ea6d1df304de183889e15
SHA512f4dff73709e495f0a940a9e5d9e3573a010a7b0a282b72743d019403a86974a3b90fb5b9a9741c2b37df2ecd1b47b3b6bfdbda2ea68d11f9ab3da82c35576610
-
Filesize
72KB
MD517b936e0a244537b7609be43c80b9abf
SHA10ab22e6a59dee6e57f50872fc27e65e4bf90e55c
SHA256a41a528961dd7f4708f438c7839157bb9c179dd023575e51760ee4766943c06a
SHA5129e4f86fb1294ed2757f28f66586da2713659b3ab5a07a99b813597d41fc127141a871b5cfc67e99e4616cc3e9f28d2007a4ffae2a6c02c04d80c0db19287f553
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD583326aa89c9918010f31dc3e28183e4e
SHA1b4cfbbb83f897adb4f482c03166bad5891e6b3ac
SHA256ce515659b0fb36f15b47ceb10afcda91c0b30b2d5cef1dd1c79656bedade7c58
SHA512b385cd63c7f2e1f146b6aeaf7d377b06e2c5728ced3c1c0a23ebdabef7e09371c761a2dd934a16b2794d0dc1fe2a02a2bbfa5f41a8f0cca0abe3b4afdcc9809f
-
Filesize
72KB
MD583326aa89c9918010f31dc3e28183e4e
SHA1b4cfbbb83f897adb4f482c03166bad5891e6b3ac
SHA256ce515659b0fb36f15b47ceb10afcda91c0b30b2d5cef1dd1c79656bedade7c58
SHA512b385cd63c7f2e1f146b6aeaf7d377b06e2c5728ced3c1c0a23ebdabef7e09371c761a2dd934a16b2794d0dc1fe2a02a2bbfa5f41a8f0cca0abe3b4afdcc9809f
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD55c2aa0284362554d769f7fe45dd0e1c7
SHA1f0726eae98e43899eabb473e827ba73465852b2b
SHA2567497ae38d6cc64f482b506b1d37ceb4448f8a69901177575b002391f8abcbfd4
SHA512bf62334f72d88cff3607f0deec03f9775232ecfecb527ab740e57104ed39140c05a699c6ed25c7178840e6a3d53ae3922438a4509ddaa2ffbbaa138a9c0e8704
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD5632d4f8b813afc31f832df2cb08f2833
SHA1e499704d70f4a68e7d5033023536043747d5c0b5
SHA2564977676d864d9e51aa2f819adb76ccf5e7e7bce59af36c7c6a94324407b9815e
SHA512039d0f30619f3bed081bb2e24ce2b9e7ee22b38783fc7b5d2194ff46d986fc09c48ece217ef78e05ed287b58f2edce0869e4fb7521773f95a304625a323c5180
-
Filesize
72KB
MD5632d4f8b813afc31f832df2cb08f2833
SHA1e499704d70f4a68e7d5033023536043747d5c0b5
SHA2564977676d864d9e51aa2f819adb76ccf5e7e7bce59af36c7c6a94324407b9815e
SHA512039d0f30619f3bed081bb2e24ce2b9e7ee22b38783fc7b5d2194ff46d986fc09c48ece217ef78e05ed287b58f2edce0869e4fb7521773f95a304625a323c5180
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD59c6279969d70ec18e4b183d8cc0fb150
SHA1a6defd4ce76271e03fa26996e1fc4a7b7ab158d6
SHA25671e159dc63f3f330725cbc33969449cb822944063bb1f8b366717389d6f9ddb9
SHA5128fb8c36609d90f04056dd3bdb16461169e88c295a52bae48c6da5efdf0bc6441c7b9b58ed20cef8c352b9ba29cb3e18b56cd9ab2d2a57794f07251407bb6b32a
-
Filesize
72KB
MD59c6279969d70ec18e4b183d8cc0fb150
SHA1a6defd4ce76271e03fa26996e1fc4a7b7ab158d6
SHA25671e159dc63f3f330725cbc33969449cb822944063bb1f8b366717389d6f9ddb9
SHA5128fb8c36609d90f04056dd3bdb16461169e88c295a52bae48c6da5efdf0bc6441c7b9b58ed20cef8c352b9ba29cb3e18b56cd9ab2d2a57794f07251407bb6b32a
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD57aafa4cc65f50f2e2d794c003fbe5ab4
SHA17612c89bb95fdd19272c6c35f9bb2cc7ed621520
SHA2569a27a656bf9e765922dae102241caad052186300168db677d351b250b5060624
SHA512f07f96ea1094655d729cd02308861ca5092ceb959f5f073b03800209f9b88ee1de0573eab9f961c671c40230325f0a81bdebd9d7daf228ab7c781969f2196482
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD58bf80abbd98f0ee3fb22a9fc0ce4be17
SHA19018da374b03695362b1faa9e6ba1952f8846ce4
SHA256e09165b3f4f512e3b69159449e87d3e21305f3a5934ea6d1df304de183889e15
SHA512f4dff73709e495f0a940a9e5d9e3573a010a7b0a282b72743d019403a86974a3b90fb5b9a9741c2b37df2ecd1b47b3b6bfdbda2ea68d11f9ab3da82c35576610
-
Filesize
72KB
MD58bf80abbd98f0ee3fb22a9fc0ce4be17
SHA19018da374b03695362b1faa9e6ba1952f8846ce4
SHA256e09165b3f4f512e3b69159449e87d3e21305f3a5934ea6d1df304de183889e15
SHA512f4dff73709e495f0a940a9e5d9e3573a010a7b0a282b72743d019403a86974a3b90fb5b9a9741c2b37df2ecd1b47b3b6bfdbda2ea68d11f9ab3da82c35576610
-
Filesize
72KB
MD517b936e0a244537b7609be43c80b9abf
SHA10ab22e6a59dee6e57f50872fc27e65e4bf90e55c
SHA256a41a528961dd7f4708f438c7839157bb9c179dd023575e51760ee4766943c06a
SHA5129e4f86fb1294ed2757f28f66586da2713659b3ab5a07a99b813597d41fc127141a871b5cfc67e99e4616cc3e9f28d2007a4ffae2a6c02c04d80c0db19287f553
-
Filesize
72KB
MD517b936e0a244537b7609be43c80b9abf
SHA10ab22e6a59dee6e57f50872fc27e65e4bf90e55c
SHA256a41a528961dd7f4708f438c7839157bb9c179dd023575e51760ee4766943c06a
SHA5129e4f86fb1294ed2757f28f66586da2713659b3ab5a07a99b813597d41fc127141a871b5cfc67e99e4616cc3e9f28d2007a4ffae2a6c02c04d80c0db19287f553
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD5341d4dfb93bbb6692c5c4a4383542055
SHA1694e7463a34b77a753d2c4f591bba2ba0c6c6472
SHA25667d98d31cf5d0f39c86e2ad98cbf46881be962315acf6a8d1544605f6a61e315
SHA5128966da5a98b1fdb85acadae661b841dd04c16253ea14f8d6f2c5c71e4c4387beae5096bb4fa8266e07ec3d6d1c2bd1c1cdd018140a5a639bc8e6e87ee37f30a4
-
Filesize
72KB
MD517b936e0a244537b7609be43c80b9abf
SHA10ab22e6a59dee6e57f50872fc27e65e4bf90e55c
SHA256a41a528961dd7f4708f438c7839157bb9c179dd023575e51760ee4766943c06a
SHA5129e4f86fb1294ed2757f28f66586da2713659b3ab5a07a99b813597d41fc127141a871b5cfc67e99e4616cc3e9f28d2007a4ffae2a6c02c04d80c0db19287f553
-
Filesize
72KB
MD583326aa89c9918010f31dc3e28183e4e
SHA1b4cfbbb83f897adb4f482c03166bad5891e6b3ac
SHA256ce515659b0fb36f15b47ceb10afcda91c0b30b2d5cef1dd1c79656bedade7c58
SHA512b385cd63c7f2e1f146b6aeaf7d377b06e2c5728ced3c1c0a23ebdabef7e09371c761a2dd934a16b2794d0dc1fe2a02a2bbfa5f41a8f0cca0abe3b4afdcc9809f
-
Filesize
72KB
MD583326aa89c9918010f31dc3e28183e4e
SHA1b4cfbbb83f897adb4f482c03166bad5891e6b3ac
SHA256ce515659b0fb36f15b47ceb10afcda91c0b30b2d5cef1dd1c79656bedade7c58
SHA512b385cd63c7f2e1f146b6aeaf7d377b06e2c5728ced3c1c0a23ebdabef7e09371c761a2dd934a16b2794d0dc1fe2a02a2bbfa5f41a8f0cca0abe3b4afdcc9809f
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD574584761754110fa6b03d516acc91bff
SHA13324b3b372c85ab3e1c5dde27a4850ddc18bf3dd
SHA256973518e07ef88a5e04a1678d483ebe63f484535b276aa303cbcbcd367641ab19
SHA512aca2e5ba6190de06e26520b7432f0b08ccb82337f21d34ca1fdd93172e6d8bfeceaa01eca6b7923a1ae694b09a572d935fd34b23cc02f1495bbe60ccac3b3131
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD55c2aa0284362554d769f7fe45dd0e1c7
SHA1f0726eae98e43899eabb473e827ba73465852b2b
SHA2567497ae38d6cc64f482b506b1d37ceb4448f8a69901177575b002391f8abcbfd4
SHA512bf62334f72d88cff3607f0deec03f9775232ecfecb527ab740e57104ed39140c05a699c6ed25c7178840e6a3d53ae3922438a4509ddaa2ffbbaa138a9c0e8704
-
Filesize
72KB
MD55c2aa0284362554d769f7fe45dd0e1c7
SHA1f0726eae98e43899eabb473e827ba73465852b2b
SHA2567497ae38d6cc64f482b506b1d37ceb4448f8a69901177575b002391f8abcbfd4
SHA512bf62334f72d88cff3607f0deec03f9775232ecfecb527ab740e57104ed39140c05a699c6ed25c7178840e6a3d53ae3922438a4509ddaa2ffbbaa138a9c0e8704
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b
-
Filesize
72KB
MD52fa5d277368abaddd74ff7e2c89f077f
SHA10174a2221cc4a16a101b4aed1c56e5e5379384ea
SHA256ce88f15bfc47ba1cb1ef5652ec174740e2ccd5f0a1aa34870acfd8bfd397063a
SHA5122684acbad3bfdbd02525296f7a5341a72ea9ad6116282c942c1816b7d8d9c163e9e6ad464256591b3ec6784db4bf57b47949ec82c0107a3b33c1c3216c2b489b