Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
204s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe
Resource
win10v2004-20221111-en
General
-
Target
32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe
-
Size
72KB
-
MD5
048fd872c64fb0cdade22c4901f89fec
-
SHA1
2ba375492286ed83480ab8ad8c84591409680659
-
SHA256
32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2
-
SHA512
1819776313f28c1fb87afc4dbb1dd37b5253d065d547b32bebc5c194a592283fad87329587bee37b02320a1846de4aecf4b7acc4c6cd68c623759c68ad56a4ea
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2P:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP7
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 652 backup.exe 1112 backup.exe 272 backup.exe 616 backup.exe 1636 backup.exe 1792 backup.exe 1500 backup.exe 1692 backup.exe 1552 backup.exe 1720 backup.exe 532 backup.exe 840 update.exe 1360 backup.exe 1064 backup.exe 2032 backup.exe 760 backup.exe 520 backup.exe 1592 backup.exe 1616 backup.exe 1612 backup.exe 1284 System Restore.exe 1680 backup.exe 1172 backup.exe 1096 backup.exe 1696 backup.exe 596 backup.exe 1436 backup.exe 1524 backup.exe 1080 backup.exe 1628 backup.exe 2012 backup.exe 1952 backup.exe 1424 backup.exe 1892 backup.exe 1928 backup.exe 1704 backup.exe 1432 backup.exe 1576 backup.exe 1488 backup.exe 1460 backup.exe 536 backup.exe 732 backup.exe 856 backup.exe 1060 backup.exe 1484 backup.exe 1772 backup.exe 1592 backup.exe 1528 backup.exe 1880 update.exe 1172 backup.exe 1096 backup.exe 1632 backup.exe 596 backup.exe 1436 backup.exe 1968 backup.exe 948 backup.exe 1552 backup.exe 2012 backup.exe 1380 backup.exe 1892 backup.exe 1944 backup.exe 1928 backup.exe 432 data.exe 1432 update.exe -
Loads dropped DLL 64 IoCs
pid Process 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 1692 backup.exe 1692 backup.exe 1552 backup.exe 1552 backup.exe 1692 backup.exe 1692 backup.exe 532 backup.exe 840 update.exe 840 update.exe 840 update.exe 840 update.exe 840 update.exe 1360 backup.exe 1360 backup.exe 1360 backup.exe 532 backup.exe 532 backup.exe 1064 backup.exe 1064 backup.exe 2032 backup.exe 2032 backup.exe 2032 backup.exe 2032 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 520 backup.exe 1080 backup.exe 1080 backup.exe 1080 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe data.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe backup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 652 backup.exe 1112 backup.exe 272 backup.exe 616 backup.exe 1636 backup.exe 1792 backup.exe 1500 backup.exe 1692 backup.exe 1552 backup.exe 1720 backup.exe 532 backup.exe 840 update.exe 1360 backup.exe 1064 backup.exe 2032 backup.exe 760 backup.exe 520 backup.exe 1592 backup.exe 1616 backup.exe 1612 backup.exe 1284 System Restore.exe 1680 backup.exe 1172 backup.exe 1096 backup.exe 1696 backup.exe 596 backup.exe 1436 backup.exe 1524 backup.exe 1080 backup.exe 1628 backup.exe 2012 backup.exe 1952 backup.exe 1424 backup.exe 1892 backup.exe 1928 backup.exe 1704 backup.exe 1432 backup.exe 1488 backup.exe 1460 backup.exe 732 backup.exe 536 backup.exe 1576 backup.exe 856 backup.exe 1060 backup.exe 1592 backup.exe 1484 backup.exe 1772 backup.exe 1528 backup.exe 1880 update.exe 1172 backup.exe 1096 backup.exe 1632 backup.exe 596 backup.exe 1436 backup.exe 1968 backup.exe 948 backup.exe 1552 backup.exe 2012 backup.exe 1380 backup.exe 1892 backup.exe 1928 backup.exe 1944 backup.exe 432 data.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 652 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 28 PID 1176 wrote to memory of 652 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 28 PID 1176 wrote to memory of 652 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 28 PID 1176 wrote to memory of 652 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 28 PID 1176 wrote to memory of 1112 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 29 PID 1176 wrote to memory of 1112 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 29 PID 1176 wrote to memory of 1112 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 29 PID 1176 wrote to memory of 1112 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 29 PID 1176 wrote to memory of 272 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 30 PID 1176 wrote to memory of 272 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 30 PID 1176 wrote to memory of 272 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 30 PID 1176 wrote to memory of 272 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 30 PID 1176 wrote to memory of 616 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 31 PID 1176 wrote to memory of 616 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 31 PID 1176 wrote to memory of 616 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 31 PID 1176 wrote to memory of 616 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 31 PID 1176 wrote to memory of 1636 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 32 PID 1176 wrote to memory of 1636 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 32 PID 1176 wrote to memory of 1636 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 32 PID 1176 wrote to memory of 1636 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 32 PID 1176 wrote to memory of 1792 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 33 PID 1176 wrote to memory of 1792 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 33 PID 1176 wrote to memory of 1792 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 33 PID 1176 wrote to memory of 1792 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 33 PID 1176 wrote to memory of 1500 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 34 PID 1176 wrote to memory of 1500 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 34 PID 1176 wrote to memory of 1500 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 34 PID 1176 wrote to memory of 1500 1176 32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe 34 PID 652 wrote to memory of 1692 652 backup.exe 35 PID 652 wrote to memory of 1692 652 backup.exe 35 PID 652 wrote to memory of 1692 652 backup.exe 35 PID 652 wrote to memory of 1692 652 backup.exe 35 PID 1692 wrote to memory of 1552 1692 backup.exe 36 PID 1692 wrote to memory of 1552 1692 backup.exe 36 PID 1692 wrote to memory of 1552 1692 backup.exe 36 PID 1692 wrote to memory of 1552 1692 backup.exe 36 PID 1552 wrote to memory of 1720 1552 backup.exe 37 PID 1552 wrote to memory of 1720 1552 backup.exe 37 PID 1552 wrote to memory of 1720 1552 backup.exe 37 PID 1552 wrote to memory of 1720 1552 backup.exe 37 PID 1692 wrote to memory of 532 1692 backup.exe 38 PID 1692 wrote to memory of 532 1692 backup.exe 38 PID 1692 wrote to memory of 532 1692 backup.exe 38 PID 1692 wrote to memory of 532 1692 backup.exe 38 PID 532 wrote to memory of 840 532 backup.exe 39 PID 532 wrote to memory of 840 532 backup.exe 39 PID 532 wrote to memory of 840 532 backup.exe 39 PID 532 wrote to memory of 840 532 backup.exe 39 PID 532 wrote to memory of 840 532 backup.exe 39 PID 532 wrote to memory of 840 532 backup.exe 39 PID 532 wrote to memory of 840 532 backup.exe 39 PID 840 wrote to memory of 1360 840 update.exe 40 PID 840 wrote to memory of 1360 840 update.exe 40 PID 840 wrote to memory of 1360 840 update.exe 40 PID 840 wrote to memory of 1360 840 update.exe 40 PID 840 wrote to memory of 1360 840 update.exe 40 PID 840 wrote to memory of 1360 840 update.exe 40 PID 840 wrote to memory of 1360 840 update.exe 40 PID 532 wrote to memory of 1064 532 backup.exe 41 PID 532 wrote to memory of 1064 532 backup.exe 41 PID 532 wrote to memory of 1064 532 backup.exe 41 PID 532 wrote to memory of 1064 532 backup.exe 41 PID 1064 wrote to memory of 2032 1064 backup.exe 42 PID 1064 wrote to memory of 2032 1064 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe"C:\Users\Admin\AppData\Local\Temp\32b11d2f78b1cf46048403afaabb8b36042ff336606c0d0669f5652ba206bcc2.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\2476607924\backup.exeC:\Users\Admin\AppData\Local\Temp\2476607924\backup.exe C:\Users\Admin\AppData\Local\Temp\2476607924\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:652 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1692 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Program Files\7-Zip\update.exe"C:\Program Files\7-Zip\update.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:520 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1080 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1424
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- System policy modification
PID:1432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Disables RegEdit via registry modification
PID:884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1184
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1428
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- System policy modification
PID:900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Disables RegEdit via registry modification
PID:1968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵PID:1160
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:188
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:1440
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:596
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1072
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1188
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:1428
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1728
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
PID:1500
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1436 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1976
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:536
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Disables RegEdit via registry modification
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:2040
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- System policy modification
PID:1744 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1072
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1588
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:268
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- System policy modification
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Disables RegEdit via registry modification
PID:752
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Drops file in Program Files directory
PID:2008 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\update.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\update.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- Modifies visibility of file extensions in Explorer
PID:920 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:1720
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928 -
C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe"C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- System policy modification
PID:1160
-
-
C:\Program Files\Common Files\System\ado\en-US\System Restore.exe"C:\Program Files\Common Files\System\ado\en-US\System Restore.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:760
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:840
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:884
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
PID:1568
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:1708
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:1628
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:768
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1368
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1596
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
PID:1996
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1556
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Drops file in Program Files directory
PID:960 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:736
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- Disables RegEdit via registry modification
PID:1704
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵PID:760
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:860
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1276
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:1620
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Drops file in Program Files directory
PID:1428 -
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:940
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵
- System policy modification
PID:740
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵
- System policy modification
PID:1584
-
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:1072
-
-
C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵PID:1944
-
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\System Restore.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\8⤵PID:1580
-
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:732 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1060
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Program Files\DVD Maker\it-IT\data.exe"C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:432
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1620
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1520
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1824 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:2004
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1112
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1576
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1564
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1056
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1632
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:1124
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- Drops file in Program Files directory
PID:1660
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
- Modifies visibility of file extensions in Explorer
PID:1540
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2040
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:1368
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:1016
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1064
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:760
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵PID:1688
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1500
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- System policy modification
PID:1284 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:596 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:1772
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Disables RegEdit via registry modification
PID:1868
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:1628
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:788
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1432 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1952
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1576
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:948
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- System policy modification
PID:1452 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Modifies visibility of file extensions in Explorer
PID:188 -
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:1868
-
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1952
-
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1460 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1772 -
C:\Program Files (x86)\Adobe\Reader 9.0\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1880 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1380 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1816
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1016
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1660
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1504
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1652
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:2036
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:816
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1688
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Drops file in Program Files directory
- System policy modification
PID:1128 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- System policy modification
PID:1976 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1188
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1096 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:944 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:1540
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:732
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵PID:1660
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1620 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵PID:1704
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Drops file in Program Files directory
PID:1720 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Disables RegEdit via registry modification
PID:1064
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1944
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1212
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:2036 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1608 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- System policy modification
PID:1804
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1440
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
- System policy modification
PID:1664 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- System policy modification
PID:996
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵PID:2016
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵PID:1172
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵PID:752
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
- Disables RegEdit via registry modification
PID:972
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:1696
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵PID:596
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\10⤵PID:1596
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1652 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:1948
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1748 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1456 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1632
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1596
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Disables RegEdit via registry modification
PID:1632 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\data.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\data.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵PID:1424
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵PID:2004
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1720
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\data.exe"C:\Program Files (x86)\Common Files\Adobe AIR\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
PID:1540 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵PID:1056
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵PID:1944
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- Disables RegEdit via registry modification
PID:1160
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:984
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:960
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1992
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:2040
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1660
-
-
C:\Program Files (x86)\Google\Update\data.exe"C:\Program Files (x86)\Google\Update\data.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1284
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Disables RegEdit via registry modification
PID:1644 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
- System policy modification
PID:1972
-
-
C:\Program Files (x86)\Internet Explorer\en-US\System Restore.exe"C:\Program Files (x86)\Internet Explorer\en-US\System Restore.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:1584
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
PID:1728
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:1976
-
-
-
-
C:\Users\System Restore.exe"C:\Users\System Restore.exe" C:\Users\4⤵
- System policy modification
PID:432 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
PID:1224 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
PID:816
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:788
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:920
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1728
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1380
-
-
C:\Users\Admin\Links\update.exeC:\Users\Admin\Links\update.exe C:\Users\Admin\Links\6⤵PID:1656
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Modifies visibility of file extensions in Explorer
PID:1948
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:1520
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
PID:1524 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1976
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:2000
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:1616
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
- System policy modification
PID:1504 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1764
-
-
C:\Windows\AppCompat\data.exeC:\Windows\AppCompat\data.exe C:\Windows\AppCompat\5⤵PID:1096
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:940
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:272
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:616
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD5d20ba1e159ebcce0c2e032ae78e34e2c
SHA101e4f520c07a0d3e268557ff62b85a57b394ce8b
SHA256314021a0f6987e3fe9a6bb97d5d08798c127c97708a940d4eb3343eef7791cd4
SHA512f8bb2dc48f869542073710fe2892a3b7268addc04db49a504eca7b0b3418ef1f2bc8ea498f07e4a35423c634354e92a4fb5431f40c699d3f26636dc64c6d11c7
-
Filesize
72KB
MD5d20ba1e159ebcce0c2e032ae78e34e2c
SHA101e4f520c07a0d3e268557ff62b85a57b394ce8b
SHA256314021a0f6987e3fe9a6bb97d5d08798c127c97708a940d4eb3343eef7791cd4
SHA512f8bb2dc48f869542073710fe2892a3b7268addc04db49a504eca7b0b3418ef1f2bc8ea498f07e4a35423c634354e92a4fb5431f40c699d3f26636dc64c6d11c7
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD500209d5421eea46b564b464a5ca70e33
SHA1ed823cc4463f737afe3615db6ece427bfcc396f5
SHA2560809dc837fc40b3bc026f7c4b0450fe5e60a79d8e356dc7b7a1c86b2390c41aa
SHA5125223284dd42be529509c88af9f9fbe9998e02e1a898b46b9299c633bc171fea10af50af7d048ec6377b29396323ade035593cf59499a6243006735c0a28d08d6
-
Filesize
72KB
MD500209d5421eea46b564b464a5ca70e33
SHA1ed823cc4463f737afe3615db6ece427bfcc396f5
SHA2560809dc837fc40b3bc026f7c4b0450fe5e60a79d8e356dc7b7a1c86b2390c41aa
SHA5125223284dd42be529509c88af9f9fbe9998e02e1a898b46b9299c633bc171fea10af50af7d048ec6377b29396323ade035593cf59499a6243006735c0a28d08d6
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD51d03b880ea424888b55e71d94b14e5bd
SHA1ca60009e987f93134e38aadc4e2976b230cfa033
SHA256c1057f54e0d4d851529e5325f7ac7b69a57920b27ec8a3d87a4a8288af952c35
SHA51257f245d52f26b9827d2343053ce9f502b7b3860b2df821beded7b7814bfcf6010adc6c10d7e80e4f7bc83f4c79ab4c038931bc20b54ebe2e7e7f17e62227ecc4
-
Filesize
72KB
MD51d03b880ea424888b55e71d94b14e5bd
SHA1ca60009e987f93134e38aadc4e2976b230cfa033
SHA256c1057f54e0d4d851529e5325f7ac7b69a57920b27ec8a3d87a4a8288af952c35
SHA51257f245d52f26b9827d2343053ce9f502b7b3860b2df821beded7b7814bfcf6010adc6c10d7e80e4f7bc83f4c79ab4c038931bc20b54ebe2e7e7f17e62227ecc4
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD5519857512de4c03afc5368c20bdc6552
SHA11312705b7cdf880f0befbef1c9a0d3f2dc0b7fa4
SHA256167ce544ddc59e0944e4a4e99c26ab6e2830c115e33e7467bba295c2158643e4
SHA512c9a15aab9599f9fd597e4638d17f0d4e3da1b6dc338dc69f340d27cc9592892a94657116ab2c6df03eefda98c71a709efe01a11117b5d0a14c2fc5bf9718fea3
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD563484db0aabbfe66cb49c087d61eb0b2
SHA139f3c6c27bc6e244a236a8887d35d5985eb6ef93
SHA256db40f95fa71a430ea73d13fb097a944d42031b14d69baa3edfaf9520f652d21f
SHA5126a177755182386d4da56cfdd4d35cb2ba758c46af9656e3e99912e643f84647758c94e04e739a59daee2f861d31ca6d263280c4a49e3caed1ce66afb0d4ca599
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD5d20ba1e159ebcce0c2e032ae78e34e2c
SHA101e4f520c07a0d3e268557ff62b85a57b394ce8b
SHA256314021a0f6987e3fe9a6bb97d5d08798c127c97708a940d4eb3343eef7791cd4
SHA512f8bb2dc48f869542073710fe2892a3b7268addc04db49a504eca7b0b3418ef1f2bc8ea498f07e4a35423c634354e92a4fb5431f40c699d3f26636dc64c6d11c7
-
Filesize
72KB
MD5d20ba1e159ebcce0c2e032ae78e34e2c
SHA101e4f520c07a0d3e268557ff62b85a57b394ce8b
SHA256314021a0f6987e3fe9a6bb97d5d08798c127c97708a940d4eb3343eef7791cd4
SHA512f8bb2dc48f869542073710fe2892a3b7268addc04db49a504eca7b0b3418ef1f2bc8ea498f07e4a35423c634354e92a4fb5431f40c699d3f26636dc64c6d11c7
-
Filesize
72KB
MD510eb426f64f787a2b272f0a493bf7399
SHA16b9b4d0ceb3d5d69bbd5715d103f62d4dc7340c2
SHA2562e31f3bf745323fbb00006a181dce61e3f205908bc23210c96f182b1a40e1fea
SHA512c7c80ef6d03c81671a0bfc2eff9bd03484337382219d1ac9ffa29980f7f2c6e4d0d7966d32faca1cd996c620b7a1abc5c419c651ef7748de2095e41b233f6e79
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD5adb36524fdeaf2713530ce1c9d02809b
SHA10a8dc6884a77eec3e2585417f10b82f0c494e5af
SHA25621b268754c128ebc479519b13c98f5a8b22336395c7e514654d87b9c2b97a57f
SHA5122286b2e2a1830eb24158893f56342d3e9011ad57e17c056aab2635b799a81b49d4e67fd03020a0a52721b4b08e51837ca5e266299a5bb2685d65005d3437846d
-
Filesize
72KB
MD500209d5421eea46b564b464a5ca70e33
SHA1ed823cc4463f737afe3615db6ece427bfcc396f5
SHA2560809dc837fc40b3bc026f7c4b0450fe5e60a79d8e356dc7b7a1c86b2390c41aa
SHA5125223284dd42be529509c88af9f9fbe9998e02e1a898b46b9299c633bc171fea10af50af7d048ec6377b29396323ade035593cf59499a6243006735c0a28d08d6
-
Filesize
72KB
MD500209d5421eea46b564b464a5ca70e33
SHA1ed823cc4463f737afe3615db6ece427bfcc396f5
SHA2560809dc837fc40b3bc026f7c4b0450fe5e60a79d8e356dc7b7a1c86b2390c41aa
SHA5125223284dd42be529509c88af9f9fbe9998e02e1a898b46b9299c633bc171fea10af50af7d048ec6377b29396323ade035593cf59499a6243006735c0a28d08d6
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD5976ee35d849f18e439cc02c34071ded0
SHA1ff07cc3e8b6e854971e5b1d55ad648561e1a5d7f
SHA256da147fcdb16c4b9c87b369e010e2fb30764fc8427fb40fedff797175e479a914
SHA512ff3e92effe526e60b0c3edb3dfe3fd01d0f79897b3486ffc0b307f69fd780d387ccd9a565ad5043c3ceb397b6b6a87556fabb2c88bcb760263828ed424cfcb96
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb
-
Filesize
72KB
MD574ebe63b4e3e1aaa6db4f554ab825a6b
SHA1704ddd6586e8fc2430c3216fb7e8a9f6146df97b
SHA2569fa2522e0dafc81a08b4a3eb128084f284bdfd70d3c4ee01bcbdf9b1103216a6
SHA512b595c2dec6a74fa5abe08ebf9027b34b259a1117eb85e9e8cbbc4a0d23e8908434b86af25ade693b9b8d6c7ba23b6638cd7fcfe4b6ec4e760b5c263035ddfffb