Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
226s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe
Resource
win10v2004-20221111-en
General
-
Target
65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe
-
Size
72KB
-
MD5
0a1fa8f639125448774cb1ba2cfdf870
-
SHA1
921f41a6155c36564b581e640d8aac8dcbd6e8ba
-
SHA256
65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8
-
SHA512
0baec6df52c5498b6f4645e9f837c4a9460425594ae0a8a5e79bb45a188f4225056d8d4795aeb7aecd4c781988f9a662a7eac84dc0f90f283454e98f9e432f5d
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2v:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrj
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 4000 backup.exe 4936 backup.exe 116 backup.exe 2832 backup.exe 3484 backup.exe 3476 backup.exe 5116 backup.exe 3568 backup.exe 1668 backup.exe 2332 backup.exe 4712 backup.exe 2708 backup.exe 3312 backup.exe 3140 backup.exe 2384 backup.exe 2296 backup.exe 4092 backup.exe 1560 backup.exe 592 backup.exe 2464 backup.exe 3116 backup.exe 3672 backup.exe 3324 System Restore.exe 1212 backup.exe 1912 backup.exe 3788 backup.exe 1056 backup.exe 1240 backup.exe 448 backup.exe 2680 backup.exe 4464 backup.exe 476 backup.exe 4580 backup.exe 3144 backup.exe 2432 backup.exe 116 backup.exe 1364 backup.exe 3376 data.exe 3160 backup.exe 1844 backup.exe 456 backup.exe 1460 update.exe 1668 backup.exe 3108 update.exe 3684 backup.exe 2228 backup.exe 2600 backup.exe 2636 System Restore.exe 2976 backup.exe 3620 backup.exe 924 backup.exe 2256 backup.exe 4092 backup.exe 1012 backup.exe 1768 backup.exe 5020 backup.exe 4356 backup.exe 4924 backup.exe 4408 backup.exe 4552 backup.exe 4328 backup.exe 4472 backup.exe 3912 backup.exe 3048 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\update.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Update\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\Office16\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe System Restore.exe File opened for modification C:\Program Files\Microsoft Office\root\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe backup.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\Programs\backup.exe backup.exe File opened for modification C:\Windows\apppatch\Custom\backup.exe backup.exe File opened for modification C:\Windows\apppatch\Custom\Custom64\backup.exe backup.exe File opened for modification C:\Windows\appcompat\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\Telemetry\data.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\backup.exe backup.exe File opened for modification C:\Windows\appcompat\encapsulation\backup.exe backup.exe File opened for modification C:\Windows\apppatch\backup.exe backup.exe File opened for modification C:\Windows\apppatch\AppPatch64\backup.exe backup.exe File opened for modification C:\Windows\apppatch\CustomSDB\backup.exe backup.exe File opened for modification C:\Windows\AppReadiness\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 4000 backup.exe 4936 backup.exe 116 backup.exe 2832 backup.exe 3484 backup.exe 3476 backup.exe 5116 backup.exe 3568 backup.exe 1668 backup.exe 2332 backup.exe 4712 backup.exe 2708 backup.exe 3312 backup.exe 3140 backup.exe 2384 backup.exe 2296 backup.exe 4092 backup.exe 1560 backup.exe 592 backup.exe 2464 backup.exe 3116 backup.exe 3672 backup.exe 3324 System Restore.exe 1212 backup.exe 1912 backup.exe 3788 backup.exe 1240 backup.exe 1056 backup.exe 448 backup.exe 4464 backup.exe 2680 backup.exe 476 backup.exe 4580 backup.exe 2432 backup.exe 3144 backup.exe 1364 backup.exe 3376 data.exe 116 backup.exe 1844 backup.exe 456 backup.exe 1460 update.exe 3160 backup.exe 1668 backup.exe 3684 backup.exe 3108 update.exe 2228 backup.exe 2600 backup.exe 2256 backup.exe 3620 backup.exe 924 backup.exe 2636 System Restore.exe 4092 backup.exe 1012 backup.exe 2976 backup.exe 1768 backup.exe 5020 backup.exe 4408 backup.exe 4924 backup.exe 4328 backup.exe 4472 backup.exe 4356 backup.exe 4552 backup.exe 3912 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 4000 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 80 PID 2572 wrote to memory of 4000 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 80 PID 2572 wrote to memory of 4000 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 80 PID 2572 wrote to memory of 4936 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 81 PID 2572 wrote to memory of 4936 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 81 PID 2572 wrote to memory of 4936 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 81 PID 2572 wrote to memory of 116 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 82 PID 2572 wrote to memory of 116 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 82 PID 2572 wrote to memory of 116 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 82 PID 2572 wrote to memory of 2832 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 83 PID 2572 wrote to memory of 2832 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 83 PID 2572 wrote to memory of 2832 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 83 PID 2572 wrote to memory of 3484 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 84 PID 2572 wrote to memory of 3484 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 84 PID 2572 wrote to memory of 3484 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 84 PID 2572 wrote to memory of 3476 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 85 PID 2572 wrote to memory of 3476 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 85 PID 2572 wrote to memory of 3476 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 85 PID 2572 wrote to memory of 5116 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 86 PID 2572 wrote to memory of 5116 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 86 PID 2572 wrote to memory of 5116 2572 65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe 86 PID 4000 wrote to memory of 3568 4000 backup.exe 87 PID 4000 wrote to memory of 3568 4000 backup.exe 87 PID 4000 wrote to memory of 3568 4000 backup.exe 87 PID 3568 wrote to memory of 1668 3568 backup.exe 88 PID 3568 wrote to memory of 1668 3568 backup.exe 88 PID 3568 wrote to memory of 1668 3568 backup.exe 88 PID 3568 wrote to memory of 2332 3568 backup.exe 89 PID 3568 wrote to memory of 2332 3568 backup.exe 89 PID 3568 wrote to memory of 2332 3568 backup.exe 89 PID 3568 wrote to memory of 4712 3568 backup.exe 90 PID 3568 wrote to memory of 4712 3568 backup.exe 90 PID 3568 wrote to memory of 4712 3568 backup.exe 90 PID 4712 wrote to memory of 2708 4712 backup.exe 91 PID 4712 wrote to memory of 2708 4712 backup.exe 91 PID 4712 wrote to memory of 2708 4712 backup.exe 91 PID 2708 wrote to memory of 3312 2708 backup.exe 92 PID 2708 wrote to memory of 3312 2708 backup.exe 92 PID 2708 wrote to memory of 3312 2708 backup.exe 92 PID 4712 wrote to memory of 3140 4712 backup.exe 93 PID 4712 wrote to memory of 3140 4712 backup.exe 93 PID 4712 wrote to memory of 3140 4712 backup.exe 93 PID 3140 wrote to memory of 2384 3140 backup.exe 94 PID 3140 wrote to memory of 2384 3140 backup.exe 94 PID 3140 wrote to memory of 2384 3140 backup.exe 94 PID 3140 wrote to memory of 2296 3140 backup.exe 95 PID 3140 wrote to memory of 2296 3140 backup.exe 95 PID 3140 wrote to memory of 2296 3140 backup.exe 95 PID 2296 wrote to memory of 4092 2296 backup.exe 96 PID 2296 wrote to memory of 4092 2296 backup.exe 96 PID 2296 wrote to memory of 4092 2296 backup.exe 96 PID 2296 wrote to memory of 1560 2296 backup.exe 97 PID 2296 wrote to memory of 1560 2296 backup.exe 97 PID 2296 wrote to memory of 1560 2296 backup.exe 97 PID 1560 wrote to memory of 592 1560 backup.exe 98 PID 1560 wrote to memory of 592 1560 backup.exe 98 PID 1560 wrote to memory of 592 1560 backup.exe 98 PID 1560 wrote to memory of 2464 1560 backup.exe 99 PID 1560 wrote to memory of 2464 1560 backup.exe 99 PID 1560 wrote to memory of 2464 1560 backup.exe 99 PID 1560 wrote to memory of 3116 1560 backup.exe 100 PID 1560 wrote to memory of 3116 1560 backup.exe 100 PID 1560 wrote to memory of 3116 1560 backup.exe 100 PID 1560 wrote to memory of 3672 1560 backup.exe 101 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe"C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1420136871\backup.exeC:\Users\Admin\AppData\Local\Temp\1420136871\backup.exe C:\Users\Admin\AppData\Local\Temp\1420136871\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4000 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2332
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4712 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3312
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2296 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4092
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:592
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3116
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3672
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3324
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3144
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3684
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5020
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4356
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- System policy modification
PID:400
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
PID:3208
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵PID:1332
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Drops file in Program Files directory
PID:2252 -
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵PID:4420
-
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\10⤵
- Modifies visibility of file extensions in Explorer
PID:4320
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3964
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵PID:3180
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
PID:4740
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵PID:4524
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵PID:1696
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵PID:3468
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
PID:5020
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\9⤵PID:2264
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\9⤵PID:2960
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵PID:4428
-
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵
- System policy modification
PID:5012
-
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:828
-
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵PID:1128
-
-
C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe"C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\8⤵PID:3500
-
-
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\8⤵PID:4456
-
-
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
PID:5096
-
-
C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\8⤵PID:1124
-
-
C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\8⤵PID:4192
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3788 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2432
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵PID:1460
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2636
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:3360
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:3260
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2680 -
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3376
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3620
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4552
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- System policy modification
PID:3064 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:4456
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵PID:3436
-
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2580
-
-
-
C:\Program Files\Common Files\microsoft shared\VC\data.exe"C:\Program Files\Common Files\microsoft shared\VC\data.exe" C:\Program Files\Common Files\microsoft shared\VC\7⤵PID:3464
-
-
C:\Program Files\Common Files\microsoft shared\VGX\backup.exe"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\7⤵PID:1212
-
-
C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3776 -
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\8⤵PID:1624
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\data.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\9⤵
- Disables RegEdit via registry modification
PID:1288
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:476 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:456 -
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:3048
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- System policy modification
PID:4940
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
PID:3828
-
-
C:\Program Files\Common Files\System\ado\it-IT\data.exe"C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:3744
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1636
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:3324
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:4540
-
-
C:\Program Files\Common Files\System\es-ES\System Restore.exe"C:\Program Files\Common Files\System\es-ES\System Restore.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- System policy modification
PID:1544
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3172 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:3236
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- System policy modification
PID:3368
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- Disables RegEdit via registry modification
PID:3064
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:4252
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵PID:4640
-
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
PID:1648
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1592
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
PID:3368
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2068
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1056 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Program Files\Google\Chrome\Application\update.exe"C:\Program Files\Google\Chrome\Application\update.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3108 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Disables RegEdit via registry modification
PID:2528
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4924
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
PID:3052
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Disables RegEdit via registry modification
PID:3400
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Disables RegEdit via registry modification
PID:4208
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:4276 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2332 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵
- Modifies visibility of file extensions in Explorer
PID:3324
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Disables RegEdit via registry modification
PID:320
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4580 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1844
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2600
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:3136
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3912
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2128
-
-
C:\Program Files\Internet Explorer\ja-JP\update.exe"C:\Program Files\Internet Explorer\ja-JP\update.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:3296
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
- System policy modification
PID:4520 -
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Drops file in Program Files directory
- System policy modification
PID:2804 -
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
- System policy modification
PID:808
-
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:4420 -
C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\8⤵PID:3208
-
-
-
C:\Program Files\Java\jdk1.8.0_66\include\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1128 -
C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\8⤵PID:592
-
C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\9⤵PID:1240
-
-
-
-
C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe"C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\7⤵PID:3124
-
-
-
C:\Program Files\Java\jre1.8.0_66\update.exe"C:\Program Files\Java\jre1.8.0_66\update.exe" C:\Program Files\Java\jre1.8.0_66\6⤵PID:4080
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Drops file in Program Files directory
PID:4928 -
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵
- Modifies visibility of file extensions in Explorer
PID:2464
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2572
-
-
C:\Program Files\Microsoft Office\root\backup.exe"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1056 -
C:\Program Files\Microsoft Office\root\Client\backup.exe"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\7⤵
- Modifies visibility of file extensions in Explorer
PID:424
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\7⤵
- Disables RegEdit via registry modification
PID:2160 -
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\8⤵PID:4016
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4276
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\8⤵PID:932
-
-
-
C:\Program Files\Microsoft Office\root\fre\backup.exe"C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\7⤵PID:4700
-
-
-
C:\Program Files\Microsoft Office\Updates\backup.exe"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\6⤵PID:2376
-
-
-
C:\Program Files\Microsoft Office 15\backup.exe"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\5⤵PID:424
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1912 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:448 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3160 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4092
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4328 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:3144 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
- Disables RegEdit via registry modification
PID:2576
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵PID:3184
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Disables RegEdit via registry modification
PID:2104
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
PID:3676 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵
- System policy modification
PID:1772
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
PID:1808
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵
- System policy modification
PID:4372
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵PID:2228
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵PID:1948
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\8⤵PID:2436
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\8⤵PID:692
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:3976 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵PID:2128
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵PID:5044
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵PID:1640
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵
- Drops file in Program Files directory
PID:8 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
PID:4284 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\10⤵
- Modifies visibility of file extensions in Explorer
PID:4164
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\10⤵PID:4764
-
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵PID:3632
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:4268 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3828 -
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2256 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
- System policy modification
PID:4796
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
PID:2680
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4820 -
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵
- Modifies visibility of file extensions in Explorer
PID:2100
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵
- System policy modification
PID:1592 -
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵PID:3656
-
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵PID:3860
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:2176 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- System policy modification
PID:4456
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:4224
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:404
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:2792 -
C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe"C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2680
-
-
C:\Program Files (x86)\Google\Update\Download\backup.exe"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\7⤵
- Modifies visibility of file extensions in Explorer
PID:4856 -
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\8⤵PID:1960
-
-
-
C:\Program Files (x86)\Google\Update\Install\backup.exe"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\7⤵PID:4784
-
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:4504
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4464 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:116 -
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2228
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Users\Admin\Downloads\data.exeC:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\6⤵PID:2068
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:224
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2708
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:808
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Modifies visibility of file extensions in Explorer
PID:1392
-
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵
- System policy modification
PID:2648
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Disables RegEdit via registry modification
PID:992 -
C:\Users\Admin\Pictures\Camera Roll\backup.exe"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1480
-
-
C:\Users\Admin\Pictures\Saved Pictures\backup.exe"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\7⤵
- System policy modification
PID:1840
-
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4316
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵PID:3012
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:3040
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
PID:3696 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Modifies visibility of file extensions in Explorer
PID:3632
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
- Disables RegEdit via registry modification
PID:1896
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1976
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
- System policy modification
PID:2192
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵
- System policy modification
PID:3792
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1964 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1756
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:3744 -
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:1960 -
C:\Windows\appcompat\appraiser\Telemetry\data.exeC:\Windows\appcompat\appraiser\Telemetry\data.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵PID:1568
-
-
-
C:\Windows\appcompat\encapsulation\backup.exeC:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3568
-
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵PID:2544
-
-
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:740 -
C:\Windows\apppatch\AppPatch64\backup.exeC:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4092
-
-
C:\Windows\apppatch\Custom\backup.exeC:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\6⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
PID:2656
-
-
C:\Windows\apppatch\CustomSDB\backup.exeC:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\6⤵PID:320
-
-
-
C:\Windows\AppReadiness\backup.exeC:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\5⤵PID:2428
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5116
-
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\1⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3508
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\1⤵
- Modifies visibility of file extensions in Explorer
PID:3996
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\1⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2208
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6
-
Filesize
72KB
MD55cfd1a12a70648208fda400fad9160d8
SHA13b29a55bfdc8c235954e8f51a23a7e6f9bf3a4ed
SHA2567ca95fb165cf0a16b1a734f212c5bfb995b748fd19da5ba0e6ae0002ba35f6a3
SHA512c0e736ff84e48284c68a5a3e4448cbcbcbf625aac5a64bee5535eca0938757ad1a5586f9eb66adc9fd9b1c9324ee2c118bbfbffe4dae94179401e50c160f4f16
-
Filesize
72KB
MD55cfd1a12a70648208fda400fad9160d8
SHA13b29a55bfdc8c235954e8f51a23a7e6f9bf3a4ed
SHA2567ca95fb165cf0a16b1a734f212c5bfb995b748fd19da5ba0e6ae0002ba35f6a3
SHA512c0e736ff84e48284c68a5a3e4448cbcbcbf625aac5a64bee5535eca0938757ad1a5586f9eb66adc9fd9b1c9324ee2c118bbfbffe4dae94179401e50c160f4f16
-
Filesize
72KB
MD5978bdac788ef8905bb544a1bd2cbf802
SHA127c9be7aa8c754d80fd3153a1cb4f0289c815144
SHA256fe5ef0ab4f864ac4dbd6560e96bb7f4a00cf34942a875e113277f8fdc9c37d13
SHA5128bd3d59c1f0e52ebcc60e49d51997f7b2b00ea41e6b244ab8dafaa0d97cabea878c574687479f282d6f6918752fd17c67715ec3b34a6b27159e83a4e893a5d59
-
Filesize
72KB
MD5978bdac788ef8905bb544a1bd2cbf802
SHA127c9be7aa8c754d80fd3153a1cb4f0289c815144
SHA256fe5ef0ab4f864ac4dbd6560e96bb7f4a00cf34942a875e113277f8fdc9c37d13
SHA5128bd3d59c1f0e52ebcc60e49d51997f7b2b00ea41e6b244ab8dafaa0d97cabea878c574687479f282d6f6918752fd17c67715ec3b34a6b27159e83a4e893a5d59
-
Filesize
72KB
MD58fbb71dc7039a3a8a8e8c288ec48db63
SHA1e811022408805a82e6a43310fe82039683f7c51c
SHA2565b569c20cc0aac3dab0b10cb3926c0c5d4fdb9e0a7649aa87fff6e41ab08787b
SHA512d09431c7becd367d0bfc64827c027ea55f7e832b50a6feae7f098dc0bd71c5c889f58420e8dfe4eb07cda6b565f1f66783bb5fa33b97600abacf09fdb92c575e
-
Filesize
72KB
MD58fbb71dc7039a3a8a8e8c288ec48db63
SHA1e811022408805a82e6a43310fe82039683f7c51c
SHA2565b569c20cc0aac3dab0b10cb3926c0c5d4fdb9e0a7649aa87fff6e41ab08787b
SHA512d09431c7becd367d0bfc64827c027ea55f7e832b50a6feae7f098dc0bd71c5c889f58420e8dfe4eb07cda6b565f1f66783bb5fa33b97600abacf09fdb92c575e
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD56273261120069d812e669aabe091b64f
SHA12b7e93dd950bdb951197dee7d631db7ccb0b5b76
SHA256dcc07a441b45b131ae545f31512327e8f0e79957eeaa2807beb6f6299fc0af39
SHA512fdf0f70cd3a379b175c3afba171555c237691c90daa58d63fc6b97fcfdd4e9cd49edf5e1161954cb8cd89b12908dd6c57f7f24cf5efcfc2caf05cd2126341ad1
-
Filesize
72KB
MD56273261120069d812e669aabe091b64f
SHA12b7e93dd950bdb951197dee7d631db7ccb0b5b76
SHA256dcc07a441b45b131ae545f31512327e8f0e79957eeaa2807beb6f6299fc0af39
SHA512fdf0f70cd3a379b175c3afba171555c237691c90daa58d63fc6b97fcfdd4e9cd49edf5e1161954cb8cd89b12908dd6c57f7f24cf5efcfc2caf05cd2126341ad1
-
Filesize
72KB
MD5d14daca447cdb85cc4fb5b5bc2e2045b
SHA18b4f94e22597b6f4c8f7c9aff4c61e1a5763e170
SHA25698fd822bd04e6e4f9aba84dbfbbd81a155da2775779ffc71594849ec18d860f7
SHA512422fd29fa23ab4d0b850526bf92351a612618c7d92d8d05540b7d29f11f096784448e91fdde8a8d779394a4bdff20f3a56b8cf91febfdcd2578d58dbf62e3dcf
-
Filesize
72KB
MD5d14daca447cdb85cc4fb5b5bc2e2045b
SHA18b4f94e22597b6f4c8f7c9aff4c61e1a5763e170
SHA25698fd822bd04e6e4f9aba84dbfbbd81a155da2775779ffc71594849ec18d860f7
SHA512422fd29fa23ab4d0b850526bf92351a612618c7d92d8d05540b7d29f11f096784448e91fdde8a8d779394a4bdff20f3a56b8cf91febfdcd2578d58dbf62e3dcf
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD50237f639256247217c6bfdac70841768
SHA17d0e8ffd67c6dcdc5e32c5ff27534c4a423d4de2
SHA256ad88df92015f48e6474c0c5b2f6d89c7cc7a49a9b0b4d41bda2453986315fea2
SHA512cce8612ada08b10d8f30e5ed9f7287fcff818bcf7dc5a5ec1e2c62a20ab790b6a630eebec39c18051bfabd61e7e93dbf5217779f8d10315cc26aef3a05c730a4
-
Filesize
72KB
MD50237f639256247217c6bfdac70841768
SHA17d0e8ffd67c6dcdc5e32c5ff27534c4a423d4de2
SHA256ad88df92015f48e6474c0c5b2f6d89c7cc7a49a9b0b4d41bda2453986315fea2
SHA512cce8612ada08b10d8f30e5ed9f7287fcff818bcf7dc5a5ec1e2c62a20ab790b6a630eebec39c18051bfabd61e7e93dbf5217779f8d10315cc26aef3a05c730a4
-
Filesize
72KB
MD5ca091200e66ed448c9b09e165cb1f758
SHA143c03277524acc16d3cef60534a11bd4937fa932
SHA2565da6713e0630b936fb521f191a8b400dea872aa80bf93db41a04afd6a2f37131
SHA51258010b3c40c9470579cdc63aee869d74a629aaf16cdeaef31f40814940d9d0adc6f041fbe2c8fe6445edc93df5ef10beec3ae03f5363a9394c46e95d4e168339
-
Filesize
72KB
MD5ca091200e66ed448c9b09e165cb1f758
SHA143c03277524acc16d3cef60534a11bd4937fa932
SHA2565da6713e0630b936fb521f191a8b400dea872aa80bf93db41a04afd6a2f37131
SHA51258010b3c40c9470579cdc63aee869d74a629aaf16cdeaef31f40814940d9d0adc6f041fbe2c8fe6445edc93df5ef10beec3ae03f5363a9394c46e95d4e168339
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD5a95db4d2b940df2a9035b52ed2b9c286
SHA109c1728911614d511f4e175d8c4e6ace922c3456
SHA2564ac95bb08e46c8a2500e283396b6ae05f545224a3e024f4440b859eade4f9193
SHA5128b2919aef9b52aeb859c8fa90b764e54f6581148ee4a7e31ac71b271a88f1d63f41e04941251300548647c5cbac1e640da7e49e13fd46a79034d21c7fac1d1ed
-
Filesize
72KB
MD5a95db4d2b940df2a9035b52ed2b9c286
SHA109c1728911614d511f4e175d8c4e6ace922c3456
SHA2564ac95bb08e46c8a2500e283396b6ae05f545224a3e024f4440b859eade4f9193
SHA5128b2919aef9b52aeb859c8fa90b764e54f6581148ee4a7e31ac71b271a88f1d63f41e04941251300548647c5cbac1e640da7e49e13fd46a79034d21c7fac1d1ed
-
Filesize
72KB
MD54aefdcfe21bb4fee2a98e3e9f18fe967
SHA13d4cb0646f6901d80564b3f6784cf5b6b8fc0a7f
SHA25650d19bb7f01b6c4465d3b6836afde146191745ed4c113eb1ce914e9522d005b5
SHA51252821970450912e88ef2f0da8e6db1573a419bac0843d90403b4af747cded6307831d0f59bf09f77da69c62337a18e87a57b6a28130e92ccb0eba45b0064b834
-
Filesize
72KB
MD54aefdcfe21bb4fee2a98e3e9f18fe967
SHA13d4cb0646f6901d80564b3f6784cf5b6b8fc0a7f
SHA25650d19bb7f01b6c4465d3b6836afde146191745ed4c113eb1ce914e9522d005b5
SHA51252821970450912e88ef2f0da8e6db1573a419bac0843d90403b4af747cded6307831d0f59bf09f77da69c62337a18e87a57b6a28130e92ccb0eba45b0064b834
-
Filesize
72KB
MD532db1f2df5a3025afc8488fb27033a14
SHA1a1b5f39cc9f59424438f41b3f293a9ec7acf1564
SHA2567c0a5420a4847b0be66ae0f0f0277d0deb43b98fd286ba9188af1df9bbce8b19
SHA512b3dc516ec32fa5f0fa05cc1154dcb19ef2b8621302bf031aa6cabcf3732111c2a00f3896f6425f3fb3183f6a433a5b8071e48a660674c06a91c3ed55ec480652
-
Filesize
72KB
MD532db1f2df5a3025afc8488fb27033a14
SHA1a1b5f39cc9f59424438f41b3f293a9ec7acf1564
SHA2567c0a5420a4847b0be66ae0f0f0277d0deb43b98fd286ba9188af1df9bbce8b19
SHA512b3dc516ec32fa5f0fa05cc1154dcb19ef2b8621302bf031aa6cabcf3732111c2a00f3896f6425f3fb3183f6a433a5b8071e48a660674c06a91c3ed55ec480652
-
Filesize
72KB
MD59ed80023db3285af912d99a10e5a334e
SHA12a139484d4cbc92e704b6edd0ca0ff4cd6a6267a
SHA25660822e03d673a9c09c796c6ca9aa5dd5d62a12bc819a8e3dbe3429780d721d62
SHA5121c9c3608285659881ebbe068be58db3b75e46710f6259b0ae7a4f11821ca105c5d2bfbf6b5968b1dcb1b19a3894d06b4b3d6f77755bc865e78c823f4db1c1f45
-
Filesize
72KB
MD59ed80023db3285af912d99a10e5a334e
SHA12a139484d4cbc92e704b6edd0ca0ff4cd6a6267a
SHA25660822e03d673a9c09c796c6ca9aa5dd5d62a12bc819a8e3dbe3429780d721d62
SHA5121c9c3608285659881ebbe068be58db3b75e46710f6259b0ae7a4f11821ca105c5d2bfbf6b5968b1dcb1b19a3894d06b4b3d6f77755bc865e78c823f4db1c1f45
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD5d60ade52b457c5c3f7c9e240f76ed4bd
SHA1d157b8ba971c4f118ee543e76d60b12757ba4f0d
SHA25648b074eddac5c3648bc85e5091c40f4573c0fee812781dbdd6b0d1b4758c85e5
SHA512f0f8aa7d231d837bbfef4a678ad12c8762ec361f120305d23b0309383f6d951bac74aec13b8dfe519ab281c2b0084683221b481346b7f783e39774d8d6fce9d1
-
Filesize
72KB
MD5d60ade52b457c5c3f7c9e240f76ed4bd
SHA1d157b8ba971c4f118ee543e76d60b12757ba4f0d
SHA25648b074eddac5c3648bc85e5091c40f4573c0fee812781dbdd6b0d1b4758c85e5
SHA512f0f8aa7d231d837bbfef4a678ad12c8762ec361f120305d23b0309383f6d951bac74aec13b8dfe519ab281c2b0084683221b481346b7f783e39774d8d6fce9d1
-
Filesize
72KB
MD55e16005b16eb143942210b9485832aea
SHA15f764626a16e006f5978ffd3284cf4c0275ac03b
SHA256f67a5c882c4d69764a701322970dec872e7b7f7497567a509e36a5a4f4ca9226
SHA512675df684f66ccd2085d52c5c2c87c467eb58798797cce2481b330bc2cbc757e510ed590919dbe69a7c2524f8857f1599d991f515ba5e58c54a1d6360e4a3913a
-
Filesize
72KB
MD55e16005b16eb143942210b9485832aea
SHA15f764626a16e006f5978ffd3284cf4c0275ac03b
SHA256f67a5c882c4d69764a701322970dec872e7b7f7497567a509e36a5a4f4ca9226
SHA512675df684f66ccd2085d52c5c2c87c467eb58798797cce2481b330bc2cbc757e510ed590919dbe69a7c2524f8857f1599d991f515ba5e58c54a1d6360e4a3913a
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6