Analysis
-
max time kernel
69s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe
Resource
win10v2004-20221111-en
General
-
Target
27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe
-
Size
72KB
-
MD5
00ef91b9925c158267e47d37a386d0f8
-
SHA1
78a07403ee5d4af497e64613d6e6c57c70d78a9f
-
SHA256
27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc
-
SHA512
6c3810cd00310fc19b3dd2504f13174a822bca562b86ac039f0dc71af608d9ca6d1f88846542e9d35135ea77f48a8cfed5ae5ab6e303a75cc31d1ba8b14c704a
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2s:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2044 backup.exe 980 update.exe 656 backup.exe 2000 backup.exe 1052 backup.exe 1520 backup.exe 1412 backup.exe 1516 backup.exe 1464 System Restore.exe 1812 backup.exe 1956 backup.exe 780 backup.exe 1540 backup.exe 916 backup.exe 472 backup.exe 1112 backup.exe 1656 backup.exe 1880 backup.exe 1584 backup.exe 1588 backup.exe 1700 backup.exe 1728 backup.exe 1696 backup.exe 1740 backup.exe 2008 backup.exe 1440 backup.exe 1236 backup.exe 540 backup.exe 1412 backup.exe 1568 data.exe 1780 backup.exe 1180 data.exe 1960 backup.exe 1812 backup.exe 1920 backup.exe 388 backup.exe 1884 backup.exe 1392 backup.exe 1016 backup.exe 1604 backup.exe 1824 backup.exe 1460 backup.exe 908 backup.exe 1124 backup.exe 1804 backup.exe 1892 System Restore.exe 940 backup.exe 1596 backup.exe 320 backup.exe 560 backup.exe 684 backup.exe 756 backup.exe 680 backup.exe 1756 backup.exe 1316 backup.exe 1520 backup.exe 796 backup.exe 1788 backup.exe 1268 backup.exe 1148 System Restore.exe 1972 backup.exe 1464 backup.exe 1388 System Restore.exe 1812 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 980 update.exe 980 update.exe 980 update.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 1516 backup.exe 1516 backup.exe 1464 System Restore.exe 1464 System Restore.exe 1516 backup.exe 1516 backup.exe 1956 backup.exe 1956 backup.exe 780 backup.exe 780 backup.exe 1956 backup.exe 1956 backup.exe 916 backup.exe 916 backup.exe 472 backup.exe 472 backup.exe 472 backup.exe 472 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1656 backup.exe 1412 backup.exe 1412 backup.exe 1412 backup.exe 1412 backup.exe 1412 backup.exe 1412 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\data.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 2044 backup.exe 980 update.exe 656 backup.exe 2000 backup.exe 1052 backup.exe 1520 backup.exe 1412 backup.exe 1516 backup.exe 1464 System Restore.exe 1812 backup.exe 1956 backup.exe 780 backup.exe 1540 backup.exe 916 backup.exe 472 backup.exe 1112 backup.exe 1656 backup.exe 1880 backup.exe 1584 backup.exe 1588 backup.exe 1700 backup.exe 1728 backup.exe 1696 backup.exe 1740 backup.exe 2008 backup.exe 1440 backup.exe 1236 backup.exe 540 backup.exe 1412 backup.exe 1568 data.exe 1780 backup.exe 1180 data.exe 1960 backup.exe 1812 backup.exe 1920 backup.exe 388 backup.exe 1884 backup.exe 1392 backup.exe 1016 backup.exe 1604 backup.exe 1824 backup.exe 1460 backup.exe 908 backup.exe 1124 backup.exe 1892 System Restore.exe 940 backup.exe 1596 backup.exe 320 backup.exe 560 backup.exe 684 backup.exe 756 backup.exe 680 backup.exe 1756 backup.exe 1316 backup.exe 1520 backup.exe 796 backup.exe 1788 backup.exe 1268 backup.exe 1148 System Restore.exe 1972 backup.exe 1464 backup.exe 1388 System Restore.exe 1812 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2044 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 26 PID 2032 wrote to memory of 2044 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 26 PID 2032 wrote to memory of 2044 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 26 PID 2032 wrote to memory of 2044 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 26 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 980 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 27 PID 2032 wrote to memory of 656 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 28 PID 2032 wrote to memory of 656 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 28 PID 2032 wrote to memory of 656 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 28 PID 2032 wrote to memory of 656 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 28 PID 2032 wrote to memory of 2000 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 29 PID 2032 wrote to memory of 2000 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 29 PID 2032 wrote to memory of 2000 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 29 PID 2032 wrote to memory of 2000 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 29 PID 2032 wrote to memory of 1052 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 30 PID 2032 wrote to memory of 1052 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 30 PID 2032 wrote to memory of 1052 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 30 PID 2032 wrote to memory of 1052 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 30 PID 2032 wrote to memory of 1520 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 31 PID 2032 wrote to memory of 1520 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 31 PID 2032 wrote to memory of 1520 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 31 PID 2032 wrote to memory of 1520 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 31 PID 2032 wrote to memory of 1412 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 32 PID 2032 wrote to memory of 1412 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 32 PID 2032 wrote to memory of 1412 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 32 PID 2032 wrote to memory of 1412 2032 27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe 32 PID 2044 wrote to memory of 1516 2044 backup.exe 33 PID 2044 wrote to memory of 1516 2044 backup.exe 33 PID 2044 wrote to memory of 1516 2044 backup.exe 33 PID 2044 wrote to memory of 1516 2044 backup.exe 33 PID 1516 wrote to memory of 1464 1516 backup.exe 34 PID 1516 wrote to memory of 1464 1516 backup.exe 34 PID 1516 wrote to memory of 1464 1516 backup.exe 34 PID 1516 wrote to memory of 1464 1516 backup.exe 34 PID 1464 wrote to memory of 1812 1464 System Restore.exe 35 PID 1464 wrote to memory of 1812 1464 System Restore.exe 35 PID 1464 wrote to memory of 1812 1464 System Restore.exe 35 PID 1464 wrote to memory of 1812 1464 System Restore.exe 35 PID 1516 wrote to memory of 1956 1516 backup.exe 36 PID 1516 wrote to memory of 1956 1516 backup.exe 36 PID 1516 wrote to memory of 1956 1516 backup.exe 36 PID 1516 wrote to memory of 1956 1516 backup.exe 36 PID 1956 wrote to memory of 780 1956 backup.exe 37 PID 1956 wrote to memory of 780 1956 backup.exe 37 PID 1956 wrote to memory of 780 1956 backup.exe 37 PID 1956 wrote to memory of 780 1956 backup.exe 37 PID 780 wrote to memory of 1540 780 backup.exe 38 PID 780 wrote to memory of 1540 780 backup.exe 38 PID 780 wrote to memory of 1540 780 backup.exe 38 PID 780 wrote to memory of 1540 780 backup.exe 38 PID 1956 wrote to memory of 916 1956 backup.exe 39 PID 1956 wrote to memory of 916 1956 backup.exe 39 PID 1956 wrote to memory of 916 1956 backup.exe 39 PID 1956 wrote to memory of 916 1956 backup.exe 39 PID 916 wrote to memory of 472 916 backup.exe 40 PID 916 wrote to memory of 472 916 backup.exe 40 PID 916 wrote to memory of 472 916 backup.exe 40 PID 916 wrote to memory of 472 916 backup.exe 40 PID 472 wrote to memory of 1112 472 backup.exe 41 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe"C:\Users\Admin\AppData\Local\Temp\27fb6a480525d0916c7769c3d6b57779cd21ed1269d012362104772cae2162bc.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3909450898\backup.exeC:\Users\Admin\AppData\Local\Temp\3909450898\backup.exe C:\Users\Admin\AppData\Local\Temp\3909450898\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\PerfLogs\System Restore.exe"C:\PerfLogs\System Restore.exe" C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:780 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1236
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1412 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1180
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:388
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1392
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1124
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:1804
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:756
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1756
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1316
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1148
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:960
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Drops file in Program Files directory
- System policy modification
PID:308 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:576
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1096
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1664
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Disables RegEdit via registry modification
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1732
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
PID:924 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:796
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Disables RegEdit via registry modification
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:640
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
PID:1412 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1664
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1120
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- System policy modification
PID:1152
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:372
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:924
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1440 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:828
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:904
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:2068
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:2168
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:2300
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1600
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1288
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1564 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:368
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:524 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
PID:900 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1512
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:1988
-
-
C:\Program Files\Common Files\System\ado\es-ES\update.exe"C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1648
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:320
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1936
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:2108
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:1052
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
PID:1132
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1700
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1924
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2004
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2060
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2200
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2308
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1468 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1112
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
PID:1120
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1596
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:560
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
PID:2000
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1632
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- System policy modification
PID:1788 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:848 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:824
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1392
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1908
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1924
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1112
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:560
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Disables RegEdit via registry modification
PID:1380
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1604
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1656
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:1564
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:2100
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:2212
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:2344
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:2480
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵PID:2656
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1444
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1124
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:1388
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1492 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1992
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1204
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:2184
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:2332
-
-
C:\Program Files\Internet Explorer\images\data.exe"C:\Program Files\Internet Explorer\images\data.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2472
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2648
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:388
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1412
-
-
C:\Program Files\Microsoft Office\System Restore.exe"C:\Program Files\Microsoft Office\System Restore.exe" C:\Program Files\Microsoft Office\5⤵PID:2084
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2228
-
-
C:\Program Files\MSBuild\data.exe"C:\Program Files\MSBuild\data.exe" C:\Program Files\MSBuild\5⤵PID:2364
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2512
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2664
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1464 -
C:\Program Files (x86)\Adobe\System Restore.exe"C:\Program Files (x86)\Adobe\System Restore.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1388 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1384 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2036
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1016 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:1492
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:336
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
PID:1052
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1520 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- System policy modification
PID:456
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
PID:1936
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
PID:1812 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:660
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1768
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:940 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1708 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1700
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:1940
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
PID:1672 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵PID:1384
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:1468
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
PID:1944 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1600
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1996
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1592
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:540 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1152
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1288
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1732
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:2092
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2220
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1952 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:1112
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1628 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1756 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- System policy modification
PID:1992
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:980
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵PID:2024
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\data.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\data.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:992
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\update.exe"C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:576 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵PID:1708
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\data.exe"C:\Program Files (x86)\Common Files\DESIGNER\data.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1144
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:372
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2076
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2176
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2316
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:796 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1060
-
-
C:\Program Files (x86)\Google\Policies\System Restore.exe"C:\Program Files (x86)\Google\Policies\System Restore.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1588
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1112
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:2140
-
-
-
C:\Program Files (x86)\Internet Explorer\System Restore.exe"C:\Program Files (x86)\Internet Explorer\System Restore.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:856
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:2568
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:2676
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1268
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2608
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Disables RegEdit via registry modification
- System policy modification
PID:684 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
PID:1816 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1128
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:824
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1800
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:2052
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2160
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2284
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2448
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:2616
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1788
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
PID:456 -
C:\Windows\addins\data.exeC:\Windows\addins\data.exe C:\Windows\addins\5⤵PID:1768
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1884
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:908
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2040
-
-
C:\Windows\Branding\update.exeC:\Windows\Branding\update.exe C:\Windows\Branding\5⤵PID:2192
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:2276
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵PID:2464
-
-
C:\Windows\debug\backup.exeC:\Windows\debug\backup.exe C:\Windows\debug\5⤵PID:2600
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\update.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:656
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1412
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5cd2f19796e710be113330544cff0caae
SHA1a1a3b49f35f234aed06cec633b0d090bdbeca89b
SHA2565d720bc0caedf5cfd34d0522e478b8a0e8f10951c3281e028985b5159b93176d
SHA5122fa5dcc98591cb3de92793c6c7f0c106a3b25927e241ce47f882d3997f9565239d73a04cc2976657cf8313e882ca8e6b941c67d96838e5b3512d6445710a7f47
-
Filesize
72KB
MD5aa962e985ec23e01453d286abfc550fb
SHA1e4dfb2a26cde89068811a77e4e1d349bec9074d2
SHA256306f99f827215ea852fc1dfd0c0a65b7623dc747053f20f30bf4479fc25abf0d
SHA5121fc22ab10d3425c0f79f63c299a78e4b77db42e6652daee33914f9fb8ac4c464be314c264ee8b14f7265e6807e280bf501d7cfdff7e9f974f51639c3e96d4403
-
Filesize
72KB
MD5aa962e985ec23e01453d286abfc550fb
SHA1e4dfb2a26cde89068811a77e4e1d349bec9074d2
SHA256306f99f827215ea852fc1dfd0c0a65b7623dc747053f20f30bf4479fc25abf0d
SHA5121fc22ab10d3425c0f79f63c299a78e4b77db42e6652daee33914f9fb8ac4c464be314c264ee8b14f7265e6807e280bf501d7cfdff7e9f974f51639c3e96d4403
-
Filesize
72KB
MD5504736cb4413e811118661ec935f714e
SHA113151e4a611e02643d013b419592e2745b0969f6
SHA256f264382229c8d90008dec1855586e8f0dac08fd0b27c044d67ead924f9442e60
SHA5128985dab51833ebd3e6711c92c558671fe9c0e9c0d411accd8d717c16c56cf64a1e1953fce76935c9cb373667d510359e1b1dfe56365bff47663fc24eebf01567
-
Filesize
72KB
MD5534a1b5dfdac1c1c58b58449c6822fa5
SHA1490e3031b7940c451c004c96b0bdb482686650a3
SHA256873a354d007535844393c3e58a00791367719b178941be2d554e2809aada56ad
SHA5126cd1405e14fc892eeb16acfb3d60b29d77a8d1fb173095e39436b37418bb0bad91f6e816ea4a2bb01f69fe9dde7d56ebd34545452ca58f1f80fdb235c592506e
-
Filesize
72KB
MD5534a1b5dfdac1c1c58b58449c6822fa5
SHA1490e3031b7940c451c004c96b0bdb482686650a3
SHA256873a354d007535844393c3e58a00791367719b178941be2d554e2809aada56ad
SHA5126cd1405e14fc892eeb16acfb3d60b29d77a8d1fb173095e39436b37418bb0bad91f6e816ea4a2bb01f69fe9dde7d56ebd34545452ca58f1f80fdb235c592506e
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD5e9b16e255f781d5ee6a5930aa5d394c2
SHA15d39460b8175b218499940e2fe40dfc9c8a47993
SHA2561d58cc83629922c6302697cb9067d5dfc86d848dd2f63ffec7830186c095691e
SHA5125e5f8ad69552048ef61f96f46c8c90dd7a58c576dbd428d0a17e7281863d6f362862c21b3b47798e5d345eddc934c1070e62830e16f42d214022e08a7cfa7658
-
Filesize
72KB
MD5e9b16e255f781d5ee6a5930aa5d394c2
SHA15d39460b8175b218499940e2fe40dfc9c8a47993
SHA2561d58cc83629922c6302697cb9067d5dfc86d848dd2f63ffec7830186c095691e
SHA5125e5f8ad69552048ef61f96f46c8c90dd7a58c576dbd428d0a17e7281863d6f362862c21b3b47798e5d345eddc934c1070e62830e16f42d214022e08a7cfa7658
-
Filesize
72KB
MD5c7e6b04b2723b4c27b7ef52274c192db
SHA137e13a579b2010aff2dc951ab43cebe32bf516db
SHA25667503553b8e14039a95c884bd50926f4a4f72a4edc79a438ce73fafd77c048cf
SHA5121e0f1ca5b8bb8fe3315651477396e8594e4ac0c19e5321bf587ffefc39ed70f33efc1427aff3c8958b39a61dc8eb22e09e56289ab3e92d56454e59d93d883c92
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD536360ec73324204cc6e0b1d4561f7683
SHA1950590f3c7bdf7c5a44a05544015fb3fe9c46cd0
SHA256bd91215aa4de82dd2a3971bd0d35a9a9675881afcf2dbb86af4e26650c146bad
SHA512958226c4b6a9748540b13fddb4e4b6680d1edac70b48a0232224135a6463ff1543f5d102fb6bc1d9c0068164f6350e6355318766c8acd29aada40533023edc06
-
Filesize
72KB
MD536360ec73324204cc6e0b1d4561f7683
SHA1950590f3c7bdf7c5a44a05544015fb3fe9c46cd0
SHA256bd91215aa4de82dd2a3971bd0d35a9a9675881afcf2dbb86af4e26650c146bad
SHA512958226c4b6a9748540b13fddb4e4b6680d1edac70b48a0232224135a6463ff1543f5d102fb6bc1d9c0068164f6350e6355318766c8acd29aada40533023edc06
-
Filesize
72KB
MD522580bd54abd8442329b827f6b83313f
SHA148d7bee35d32c3f438eb275a8674df31d23ab33c
SHA25627a6e5f8b90a71573214b070acb9850abbae76b041269f92b4606bec539f60b9
SHA5125cccdb2b476f4686e0203bb35bbe1d01e1b94e925f32ccddb71a079e63a5b79bc01887431e75de751aba84f71c67cb97c99cee625c4d6da2fba6e20314ff7e05
-
Filesize
72KB
MD522580bd54abd8442329b827f6b83313f
SHA148d7bee35d32c3f438eb275a8674df31d23ab33c
SHA25627a6e5f8b90a71573214b070acb9850abbae76b041269f92b4606bec539f60b9
SHA5125cccdb2b476f4686e0203bb35bbe1d01e1b94e925f32ccddb71a079e63a5b79bc01887431e75de751aba84f71c67cb97c99cee625c4d6da2fba6e20314ff7e05
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5530d317a07515b2bea20e307ed90ba91
SHA15a6d5eaa023047e79aefea42d4fa8ea5e805e830
SHA256155e777a8c1595dc684577a487348bec9d6bad87b69692425e98c3e8adb06b88
SHA51215dd7ad7f2b18f25eff071fe2bea020dd2c5084c0773a74b4b969d3bcaee36bc2620f7add2cd6724f374332e67a7951f7b45b6a5cf6b7d83d7c5c1ffa90471be
-
Filesize
72KB
MD5530d317a07515b2bea20e307ed90ba91
SHA15a6d5eaa023047e79aefea42d4fa8ea5e805e830
SHA256155e777a8c1595dc684577a487348bec9d6bad87b69692425e98c3e8adb06b88
SHA51215dd7ad7f2b18f25eff071fe2bea020dd2c5084c0773a74b4b969d3bcaee36bc2620f7add2cd6724f374332e67a7951f7b45b6a5cf6b7d83d7c5c1ffa90471be
-
Filesize
72KB
MD5cd2f19796e710be113330544cff0caae
SHA1a1a3b49f35f234aed06cec633b0d090bdbeca89b
SHA2565d720bc0caedf5cfd34d0522e478b8a0e8f10951c3281e028985b5159b93176d
SHA5122fa5dcc98591cb3de92793c6c7f0c106a3b25927e241ce47f882d3997f9565239d73a04cc2976657cf8313e882ca8e6b941c67d96838e5b3512d6445710a7f47
-
Filesize
72KB
MD5cd2f19796e710be113330544cff0caae
SHA1a1a3b49f35f234aed06cec633b0d090bdbeca89b
SHA2565d720bc0caedf5cfd34d0522e478b8a0e8f10951c3281e028985b5159b93176d
SHA5122fa5dcc98591cb3de92793c6c7f0c106a3b25927e241ce47f882d3997f9565239d73a04cc2976657cf8313e882ca8e6b941c67d96838e5b3512d6445710a7f47
-
Filesize
72KB
MD5aa962e985ec23e01453d286abfc550fb
SHA1e4dfb2a26cde89068811a77e4e1d349bec9074d2
SHA256306f99f827215ea852fc1dfd0c0a65b7623dc747053f20f30bf4479fc25abf0d
SHA5121fc22ab10d3425c0f79f63c299a78e4b77db42e6652daee33914f9fb8ac4c464be314c264ee8b14f7265e6807e280bf501d7cfdff7e9f974f51639c3e96d4403
-
Filesize
72KB
MD5aa962e985ec23e01453d286abfc550fb
SHA1e4dfb2a26cde89068811a77e4e1d349bec9074d2
SHA256306f99f827215ea852fc1dfd0c0a65b7623dc747053f20f30bf4479fc25abf0d
SHA5121fc22ab10d3425c0f79f63c299a78e4b77db42e6652daee33914f9fb8ac4c464be314c264ee8b14f7265e6807e280bf501d7cfdff7e9f974f51639c3e96d4403
-
Filesize
72KB
MD5504736cb4413e811118661ec935f714e
SHA113151e4a611e02643d013b419592e2745b0969f6
SHA256f264382229c8d90008dec1855586e8f0dac08fd0b27c044d67ead924f9442e60
SHA5128985dab51833ebd3e6711c92c558671fe9c0e9c0d411accd8d717c16c56cf64a1e1953fce76935c9cb373667d510359e1b1dfe56365bff47663fc24eebf01567
-
Filesize
72KB
MD5504736cb4413e811118661ec935f714e
SHA113151e4a611e02643d013b419592e2745b0969f6
SHA256f264382229c8d90008dec1855586e8f0dac08fd0b27c044d67ead924f9442e60
SHA5128985dab51833ebd3e6711c92c558671fe9c0e9c0d411accd8d717c16c56cf64a1e1953fce76935c9cb373667d510359e1b1dfe56365bff47663fc24eebf01567
-
Filesize
72KB
MD5534a1b5dfdac1c1c58b58449c6822fa5
SHA1490e3031b7940c451c004c96b0bdb482686650a3
SHA256873a354d007535844393c3e58a00791367719b178941be2d554e2809aada56ad
SHA5126cd1405e14fc892eeb16acfb3d60b29d77a8d1fb173095e39436b37418bb0bad91f6e816ea4a2bb01f69fe9dde7d56ebd34545452ca58f1f80fdb235c592506e
-
Filesize
72KB
MD5534a1b5dfdac1c1c58b58449c6822fa5
SHA1490e3031b7940c451c004c96b0bdb482686650a3
SHA256873a354d007535844393c3e58a00791367719b178941be2d554e2809aada56ad
SHA5126cd1405e14fc892eeb16acfb3d60b29d77a8d1fb173095e39436b37418bb0bad91f6e816ea4a2bb01f69fe9dde7d56ebd34545452ca58f1f80fdb235c592506e
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD5e9b16e255f781d5ee6a5930aa5d394c2
SHA15d39460b8175b218499940e2fe40dfc9c8a47993
SHA2561d58cc83629922c6302697cb9067d5dfc86d848dd2f63ffec7830186c095691e
SHA5125e5f8ad69552048ef61f96f46c8c90dd7a58c576dbd428d0a17e7281863d6f362862c21b3b47798e5d345eddc934c1070e62830e16f42d214022e08a7cfa7658
-
Filesize
72KB
MD5e9b16e255f781d5ee6a5930aa5d394c2
SHA15d39460b8175b218499940e2fe40dfc9c8a47993
SHA2561d58cc83629922c6302697cb9067d5dfc86d848dd2f63ffec7830186c095691e
SHA5125e5f8ad69552048ef61f96f46c8c90dd7a58c576dbd428d0a17e7281863d6f362862c21b3b47798e5d345eddc934c1070e62830e16f42d214022e08a7cfa7658
-
Filesize
72KB
MD5c7e6b04b2723b4c27b7ef52274c192db
SHA137e13a579b2010aff2dc951ab43cebe32bf516db
SHA25667503553b8e14039a95c884bd50926f4a4f72a4edc79a438ce73fafd77c048cf
SHA5121e0f1ca5b8bb8fe3315651477396e8594e4ac0c19e5321bf587ffefc39ed70f33efc1427aff3c8958b39a61dc8eb22e09e56289ab3e92d56454e59d93d883c92
-
Filesize
72KB
MD5c7e6b04b2723b4c27b7ef52274c192db
SHA137e13a579b2010aff2dc951ab43cebe32bf516db
SHA25667503553b8e14039a95c884bd50926f4a4f72a4edc79a438ce73fafd77c048cf
SHA5121e0f1ca5b8bb8fe3315651477396e8594e4ac0c19e5321bf587ffefc39ed70f33efc1427aff3c8958b39a61dc8eb22e09e56289ab3e92d56454e59d93d883c92
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD5b11b322c7135570264ae6aa282c672fc
SHA1229138b02eba1d98234b861e780c65a07452ba44
SHA256250c14489dd96a3ae35e7efa62bf863181a89ed19d707cbe467f3b466d87e2d1
SHA512aaf557402eaa8e6eb692c239396de35b3f66d81d802b0512b856bdb6af9698820d8980de9fee22ea2bf380cd45a3383e5eb379f67cbc8c728fe52ddd0e4fff13
-
Filesize
72KB
MD5c7e6b04b2723b4c27b7ef52274c192db
SHA137e13a579b2010aff2dc951ab43cebe32bf516db
SHA25667503553b8e14039a95c884bd50926f4a4f72a4edc79a438ce73fafd77c048cf
SHA5121e0f1ca5b8bb8fe3315651477396e8594e4ac0c19e5321bf587ffefc39ed70f33efc1427aff3c8958b39a61dc8eb22e09e56289ab3e92d56454e59d93d883c92
-
Filesize
72KB
MD536360ec73324204cc6e0b1d4561f7683
SHA1950590f3c7bdf7c5a44a05544015fb3fe9c46cd0
SHA256bd91215aa4de82dd2a3971bd0d35a9a9675881afcf2dbb86af4e26650c146bad
SHA512958226c4b6a9748540b13fddb4e4b6680d1edac70b48a0232224135a6463ff1543f5d102fb6bc1d9c0068164f6350e6355318766c8acd29aada40533023edc06
-
Filesize
72KB
MD536360ec73324204cc6e0b1d4561f7683
SHA1950590f3c7bdf7c5a44a05544015fb3fe9c46cd0
SHA256bd91215aa4de82dd2a3971bd0d35a9a9675881afcf2dbb86af4e26650c146bad
SHA512958226c4b6a9748540b13fddb4e4b6680d1edac70b48a0232224135a6463ff1543f5d102fb6bc1d9c0068164f6350e6355318766c8acd29aada40533023edc06
-
Filesize
72KB
MD522580bd54abd8442329b827f6b83313f
SHA148d7bee35d32c3f438eb275a8674df31d23ab33c
SHA25627a6e5f8b90a71573214b070acb9850abbae76b041269f92b4606bec539f60b9
SHA5125cccdb2b476f4686e0203bb35bbe1d01e1b94e925f32ccddb71a079e63a5b79bc01887431e75de751aba84f71c67cb97c99cee625c4d6da2fba6e20314ff7e05
-
Filesize
72KB
MD522580bd54abd8442329b827f6b83313f
SHA148d7bee35d32c3f438eb275a8674df31d23ab33c
SHA25627a6e5f8b90a71573214b070acb9850abbae76b041269f92b4606bec539f60b9
SHA5125cccdb2b476f4686e0203bb35bbe1d01e1b94e925f32ccddb71a079e63a5b79bc01887431e75de751aba84f71c67cb97c99cee625c4d6da2fba6e20314ff7e05
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5feeb311bfb9d1eb5938d734d8e8ee0e9
SHA17e528463b9aef50c31145cbb223e676980231e92
SHA256fca30eade69f2fb877373c9c20c3be55fbf03cfeac362a82e06672756d1afbd6
SHA512b197260d05170cf3e639b4e1ed7b3f82d7b7e976cd2cc9d0a551adc0a04d0ec77c5174101c42531391dcb219ab3922bb03889600a1e838696c679717c487fb69
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a
-
Filesize
72KB
MD5cbafea43c1ff02c9208fe7b18f87774f
SHA14ef3ec35b6c7e914929294de1884782ef78f0adf
SHA256cb7850dc42da6c8ad2d459e6c0dcac224fc11b7bb99db0e7a951c4e2b31901c7
SHA512bc5e99258c96967acffd848f72fab9b0830d7f2066eb347dd6755a304cd8b1d3232e3606e5b3d43d9614f750ce8b4841fa10155cf42c3e9a01c4dd26fc6cb56a