Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:25
Static task
static1
Behavioral task
behavioral1
Sample
19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe
Resource
win10v2004-20221111-en
General
-
Target
19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe
-
Size
72KB
-
MD5
2b8d91984ebe7a2a1068ec976386fbe0
-
SHA1
5518fafb476fa1d8be8a6bb73399b6352325fc72
-
SHA256
19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db
-
SHA512
6b68ebe69c5b7baa32722187a6b5b5a83039077ee8ce1ea92290a48eb073db6fe9917eaaf23b9777a6b8e04b14a8c7e37f34611da1268feacb72bb4e2e964d03
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2o:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 928 backup.exe 1280 backup.exe 1712 backup.exe 1412 backup.exe 1276 backup.exe 1924 backup.exe 288 backup.exe 428 backup.exe 276 backup.exe 1328 backup.exe 848 backup.exe 1140 backup.exe 1788 backup.exe 1192 backup.exe 1972 backup.exe 640 backup.exe 1100 backup.exe 1020 backup.exe 1796 backup.exe 1552 backup.exe 1376 backup.exe 1732 update.exe 1604 backup.exe 1276 backup.exe 636 data.exe 1924 backup.exe 580 backup.exe 1188 backup.exe 1704 backup.exe 1708 backup.exe 1632 backup.exe 1980 backup.exe 1564 backup.exe 1084 backup.exe 1612 backup.exe 520 backup.exe 676 backup.exe 1820 backup.exe 1788 data.exe 1300 backup.exe 1436 backup.exe 1644 backup.exe 1220 backup.exe 1304 backup.exe 1848 backup.exe 2028 backup.exe 936 backup.exe 956 backup.exe 1796 System Restore.exe 1208 backup.exe 1376 backup.exe 1412 backup.exe 1116 backup.exe 1932 backup.exe 840 backup.exe 432 backup.exe 468 backup.exe 1036 backup.exe 1568 backup.exe 1708 update.exe 1936 backup.exe 692 backup.exe 1312 backup.exe 880 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 428 backup.exe 428 backup.exe 276 backup.exe 276 backup.exe 428 backup.exe 428 backup.exe 848 backup.exe 848 backup.exe 1140 backup.exe 1140 backup.exe 848 backup.exe 848 backup.exe 1192 backup.exe 1192 backup.exe 1972 backup.exe 1972 backup.exe 1972 backup.exe 1972 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1732 update.exe 1732 update.exe 1732 update.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1100 backup.exe 1704 backup.exe 1704 backup.exe 1704 backup.exe 1704 backup.exe 1704 backup.exe 1704 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe backup.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\System Restore.exe backup.exe File opened for modification C:\Windows\AppPatch\data.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 928 backup.exe 1280 backup.exe 1712 backup.exe 1412 backup.exe 1276 backup.exe 1924 backup.exe 288 backup.exe 428 backup.exe 276 backup.exe 1328 backup.exe 848 backup.exe 1140 backup.exe 1788 backup.exe 1192 backup.exe 1972 backup.exe 640 backup.exe 1100 backup.exe 1020 backup.exe 1796 backup.exe 1552 backup.exe 1376 backup.exe 1732 update.exe 1604 backup.exe 1276 backup.exe 636 data.exe 1924 backup.exe 580 backup.exe 1188 backup.exe 1704 backup.exe 1708 backup.exe 1632 backup.exe 1980 backup.exe 1564 backup.exe 1084 backup.exe 1612 backup.exe 520 backup.exe 676 backup.exe 1820 backup.exe 1788 data.exe 1300 backup.exe 1436 backup.exe 1644 backup.exe 1220 backup.exe 1304 backup.exe 1848 backup.exe 2028 backup.exe 956 backup.exe 1796 System Restore.exe 1208 backup.exe 1376 backup.exe 1412 backup.exe 1116 backup.exe 1932 backup.exe 840 backup.exe 432 backup.exe 468 backup.exe 1036 backup.exe 1568 backup.exe 1708 update.exe 1936 backup.exe 692 backup.exe 1312 backup.exe 880 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 928 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 27 PID 1940 wrote to memory of 928 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 27 PID 1940 wrote to memory of 928 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 27 PID 1940 wrote to memory of 928 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 27 PID 1940 wrote to memory of 1280 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 28 PID 1940 wrote to memory of 1280 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 28 PID 1940 wrote to memory of 1280 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 28 PID 1940 wrote to memory of 1280 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 28 PID 1940 wrote to memory of 1712 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 29 PID 1940 wrote to memory of 1712 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 29 PID 1940 wrote to memory of 1712 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 29 PID 1940 wrote to memory of 1712 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 29 PID 1940 wrote to memory of 1412 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 30 PID 1940 wrote to memory of 1412 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 30 PID 1940 wrote to memory of 1412 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 30 PID 1940 wrote to memory of 1412 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 30 PID 1940 wrote to memory of 1276 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 31 PID 1940 wrote to memory of 1276 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 31 PID 1940 wrote to memory of 1276 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 31 PID 1940 wrote to memory of 1276 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 31 PID 1940 wrote to memory of 1924 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 32 PID 1940 wrote to memory of 1924 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 32 PID 1940 wrote to memory of 1924 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 32 PID 1940 wrote to memory of 1924 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 32 PID 1940 wrote to memory of 288 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 33 PID 1940 wrote to memory of 288 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 33 PID 1940 wrote to memory of 288 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 33 PID 1940 wrote to memory of 288 1940 19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe 33 PID 928 wrote to memory of 428 928 backup.exe 34 PID 928 wrote to memory of 428 928 backup.exe 34 PID 928 wrote to memory of 428 928 backup.exe 34 PID 928 wrote to memory of 428 928 backup.exe 34 PID 428 wrote to memory of 276 428 backup.exe 35 PID 428 wrote to memory of 276 428 backup.exe 35 PID 428 wrote to memory of 276 428 backup.exe 35 PID 428 wrote to memory of 276 428 backup.exe 35 PID 276 wrote to memory of 1328 276 backup.exe 36 PID 276 wrote to memory of 1328 276 backup.exe 36 PID 276 wrote to memory of 1328 276 backup.exe 36 PID 276 wrote to memory of 1328 276 backup.exe 36 PID 428 wrote to memory of 848 428 backup.exe 37 PID 428 wrote to memory of 848 428 backup.exe 37 PID 428 wrote to memory of 848 428 backup.exe 37 PID 428 wrote to memory of 848 428 backup.exe 37 PID 848 wrote to memory of 1140 848 backup.exe 38 PID 848 wrote to memory of 1140 848 backup.exe 38 PID 848 wrote to memory of 1140 848 backup.exe 38 PID 848 wrote to memory of 1140 848 backup.exe 38 PID 1140 wrote to memory of 1788 1140 backup.exe 39 PID 1140 wrote to memory of 1788 1140 backup.exe 39 PID 1140 wrote to memory of 1788 1140 backup.exe 39 PID 1140 wrote to memory of 1788 1140 backup.exe 39 PID 848 wrote to memory of 1192 848 backup.exe 40 PID 848 wrote to memory of 1192 848 backup.exe 40 PID 848 wrote to memory of 1192 848 backup.exe 40 PID 848 wrote to memory of 1192 848 backup.exe 40 PID 1192 wrote to memory of 1972 1192 backup.exe 41 PID 1192 wrote to memory of 1972 1192 backup.exe 41 PID 1192 wrote to memory of 1972 1192 backup.exe 41 PID 1192 wrote to memory of 1972 1192 backup.exe 41 PID 1972 wrote to memory of 640 1972 backup.exe 42 PID 1972 wrote to memory of 640 1972 backup.exe 42 PID 1972 wrote to memory of 640 1972 backup.exe 42 PID 1972 wrote to memory of 640 1972 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe"C:\Users\Admin\AppData\Local\Temp\19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3278541491\backup.exeC:\Users\Admin\AppData\Local\Temp\3278541491\backup.exe C:\Users\Admin\AppData\Local\Temp\3278541491\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1328
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1140 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1100 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1732
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:636
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1084
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:676
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1820
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1300
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1848
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1208
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:880 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:520
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1916
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
PID:1912
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- System policy modification
PID:1788
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1432 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Disables RegEdit via registry modification
PID:1148
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1524 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:640
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1120
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Disables RegEdit via registry modification
PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1556
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Drops file in Program Files directory
PID:1396 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:852
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
PID:1364
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- System policy modification
PID:1928
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:288
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Drops file in Program Files directory
- System policy modification
PID:432 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:468
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵
- Modifies visibility of file extensions in Explorer
PID:1188
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:1840
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1568 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
PID:1600
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
PID:1980 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
PID:812 -
C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe"C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:692
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1328
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1900
-
-
C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe"C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:540
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
PID:1540
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1476
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:792
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:316
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1920
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
PID:880
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1436
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1740
-
-
C:\Program Files\Common Files\System\msadc\update.exe"C:\Program Files\Common Files\System\msadc\update.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Drops file in Program Files directory
PID:2032 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1524
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵PID:1512
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵PID:1724
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:1880
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1188
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\update.exe"C:\Program Files\Common Files\System\msadc\ja-JP\update.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:1632
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1748 -
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2000
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:1820
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1704
-
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵PID:1300
-
-
C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\update.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1184
-
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:1660
-
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:640 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵PID:960
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:844
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:912
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
PID:1924
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:868
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1248
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1584 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
PID:1772 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:812
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
PID:316
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1908
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:360
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1560
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1176
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Disables RegEdit via registry modification
PID:1412
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- System policy modification
PID:1172
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1320
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
- Modifies visibility of file extensions in Explorer
PID:1924
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:1800
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1636
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:836
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵
- Disables RegEdit via registry modification
PID:1328
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:584
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵PID:1312
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:316
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\8⤵
- Disables RegEdit via registry modification
PID:1740
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\8⤵PID:360
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1228
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1376
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1512 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1172 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:912 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
PID:324
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
PID:520
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
- Disables RegEdit via registry modification
PID:1900
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2036
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Disables RegEdit via registry modification
PID:1740 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
- System policy modification
PID:1880 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵PID:676
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵
- Modifies visibility of file extensions in Explorer
PID:1820
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1104
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1140 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- System policy modification
PID:1196
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1796
-
-
C:\Program Files\Internet Explorer\es-ES\data.exe"C:\Program Files\Internet Explorer\es-ES\data.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1328
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Disables RegEdit via registry modification
PID:1484 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:1996
-
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:916
-
-
-
C:\Program Files\Java\jre7\data.exe"C:\Program Files\Java\jre7\data.exe" C:\Program Files\Java\jre7\6⤵PID:1972
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:316 -
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1772 -
C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\7⤵PID:324
-
-
C:\Program Files\Microsoft Games\Chess\en-US\backup.exe"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\7⤵PID:1704
-
-
C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\7⤵PID:1172
-
-
-
C:\Program Files\Microsoft Games\FreeCell\data.exe"C:\Program Files\Microsoft Games\FreeCell\data.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵PID:432
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1912
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2044 -
C:\Program Files (x86)\Adobe\data.exe"C:\Program Files (x86)\Adobe\data.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
PID:972 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1280 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- System policy modification
PID:1172
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
PID:1604 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1800
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:468
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1568
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1100
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:1540
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1920
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- System policy modification
PID:980 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- System policy modification
PID:700
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:956
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1796 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:268 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1200
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:1116
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
PID:1696 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1760
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
PID:392 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Disables RegEdit via registry modification
PID:1628
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1708 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- System policy modification
PID:2024
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
PID:2036 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
PID:812
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
PID:1596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1908
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
PID:988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Drops file in Program Files directory
- System policy modification
PID:956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- System policy modification
PID:1176
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:636
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
- System policy modification
PID:1244 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:1068
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵PID:1696
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- System policy modification
PID:1188 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵PID:468
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:276
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
- Drops file in Program Files directory
PID:2024 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1908 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\10⤵
- System policy modification
PID:628
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\10⤵
- Drops file in Program Files directory
PID:1720 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵PID:568
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵PID:1176
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Disables RegEdit via registry modification
PID:880 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:580
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
PID:1476 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1424 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:636
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:2040
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:2036
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1540 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:288
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:836
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:852
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:360 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:840
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:1144
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:1116
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2000 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1416
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:1600
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1392
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1584
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1544
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1980 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:268
-
-
C:\Windows\AppCompat\System Restore.exe"C:\Windows\AppCompat\System Restore.exe" C:\Windows\AppCompat\5⤵PID:1632
-
-
C:\Windows\AppPatch\data.exeC:\Windows\AppPatch\data.exe C:\Windows\AppPatch\5⤵PID:1644
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:288
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5b4aa8fe334c99daf6260fccee528f8b8
SHA1153fb27fe761746d8ff5fb8186114d6ef36a7cf6
SHA256a5206534969946e5ba3a302e22af265c6064132e9ed531832a33f4a45e8f4714
SHA51226c00b0930f20ce306a7cd6a0f611b02765a33f322301fa81f68baa830a04ea5ecde5201ea7f6b1cdd26dd6a67f2345a433580e30da17b44a7c5a81e580e12fd
-
Filesize
72KB
MD5b4aa8fe334c99daf6260fccee528f8b8
SHA1153fb27fe761746d8ff5fb8186114d6ef36a7cf6
SHA256a5206534969946e5ba3a302e22af265c6064132e9ed531832a33f4a45e8f4714
SHA51226c00b0930f20ce306a7cd6a0f611b02765a33f322301fa81f68baa830a04ea5ecde5201ea7f6b1cdd26dd6a67f2345a433580e30da17b44a7c5a81e580e12fd
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD5b24ccf75edc2d1814a6f1ba66caadbd1
SHA15bea7e51db433bdf7823479f88ecea2a48a9ccf5
SHA2565d9c99267527122adfc5bc932a4c4776da541299c71c0dc9ca18d3a849be6b5a
SHA51231a6e3ca9772ce51cec135eee8029c8d8d6e894162fbb481446b3459d3630573bf52342118fffd236b67eb8508da794add77dde15363137ee4a76f5992250b5c
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD59ee3244dfe69f73cb71b5ff39b590d36
SHA1e6084b913acca84087b3aeb21abab452da84f35d
SHA256b935f486b6b47aec1c5ee5ac5c1c46f0ca068d7a42735e180338b96a87895c18
SHA51216eeb7e3532aae3be6be33a5102a1dc240ccaa50310d987c12061afeb02b426ae2755593955aa7fc3cd1287bf6095d321a6044d964272b231f4a5a3659e2d046
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD53bd52d85820c4cbc722c9647603c73b7
SHA1f349afae60ad2c95863d19df44bdb48abc110ffb
SHA25670e35c46fe4aadaa1db1f4ec1c41c7b296673718a4c038b32caef6e75135d17b
SHA5123e541c889700f0d3cb3ef04b59fec1d7f4007e76283b43b3368176e1a0bcf9dc9fe68916f6d38016f609afeed986f3767554589fb57d31113695ba1f4ead7ca3
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD59888e3e175ba6178895cc0f8d1bed5b7
SHA135858b96d7071bd0f02388f04b7fa83ce923ffca
SHA2565242c3c77013a9546439e09ba1acfaa578c210589993d70ad7240db88bcdad92
SHA512254d4487e0120292a649ebfffc5021239aac8f6415ad08afbe18c1166f647ac5f718a6d8901af9fb9926bd28ee21511e1b21f214dc30f32243d943e06d24a452
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5277d7dd4118613e4cee84c72c4ee33c8
SHA1705d50629b21685f5924838e56998290f50905c9
SHA256d493d2f5ab61a6d8689ee4d1004a69bb7163239d76ce7f306ece541920728801
SHA51240c9a830fdf3184be6ca27aef7c4f8bb4c39347d237ce1c8a14fa8309f6a02a8aa56e439ebd5eedee221f43f7ec9a4ae0f3bdf0ebc43c11336dd0f178f69ad7b
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2
-
Filesize
72KB
MD5305f0f2e6d27d6b897cf6c1372f88e2b
SHA159a39b58e2a2b5a5138b187c3113fc759a0069d5
SHA256ccfc519df394a4cca4dbe3275193d9dfa16d5208f28c8cd2af59d3eebaebc854
SHA512b2eb63338415aca6f4bbc35e7a32c596904cb0abdaedf6d4af18c681da7174816a427363be00e94721455c18983d2d309a23d6ccbe3d39ab39865f91ef6f5ba2