Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe
Resource
win10v2004-20220812-en
General
-
Target
79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe
-
Size
72KB
-
MD5
33b337eab7e192a62cdef3849dd905fb
-
SHA1
b138c38845b7ac6bfef38049dcc592f824ca64ac
-
SHA256
79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0
-
SHA512
f75b6333e88516e1182cedc497d26b7f1b59c994441122e93646a1dba9bd68256c2663e644b1a5c70e72792eff99244c6b44079ab40d8a373f8ba0278b71cf9a
-
SSDEEP
384:N6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oGr:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrO
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1948 update.exe 1936 backup.exe 1088 backup.exe 1312 backup.exe 1816 backup.exe 1712 backup.exe 612 System Restore.exe 2004 System Restore.exe 468 backup.exe 1964 backup.exe 820 backup.exe 864 backup.exe 1628 backup.exe 536 backup.exe 920 backup.exe 1608 backup.exe 1800 backup.exe 1868 backup.exe 1408 backup.exe 2020 backup.exe 1204 backup.exe 1120 backup.exe 1960 backup.exe 636 update.exe 1544 backup.exe 1804 backup.exe 1536 backup.exe 1972 backup.exe 360 backup.exe 612 backup.exe 1980 backup.exe 1876 backup.exe 768 backup.exe 1496 backup.exe 1528 backup.exe 1196 backup.exe 1976 backup.exe 972 backup.exe 1532 backup.exe 108 data.exe 1160 backup.exe 1604 backup.exe 1748 backup.exe 1408 backup.exe 2020 backup.exe 1204 backup.exe 1784 backup.exe 1120 backup.exe 568 data.exe 1740 backup.exe 1544 backup.exe 1292 backup.exe 860 System Restore.exe 1984 backup.exe 1156 backup.exe 1708 backup.exe 1716 System Restore.exe 2012 backup.exe 1912 backup.exe 820 backup.exe 552 backup.exe 1732 backup.exe 1600 backup.exe 988 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 1948 update.exe 1948 update.exe 1948 update.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 1088 backup.exe 1088 backup.exe 1312 backup.exe 1312 backup.exe 1312 backup.exe 1312 backup.exe 1312 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 1088 backup.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 1088 backup.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 2004 System Restore.exe 2004 System Restore.exe 2004 System Restore.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 2004 System Restore.exe 2004 System Restore.exe 1964 backup.exe 1964 backup.exe 1964 backup.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 1964 backup.exe 1964 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 2004 System Restore.exe 2004 System Restore.exe 536 backup.exe 536 backup.exe 536 backup.exe 536 backup.exe 536 backup.exe 920 backup.exe 920 backup.exe 920 backup.exe 920 backup.exe 920 backup.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 920 backup.exe 920 backup.exe 1800 backup.exe 1800 backup.exe 1800 backup.exe 1800 backup.exe 1800 backup.exe 1868 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files\Google\System Restore.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 1948 update.exe 1936 backup.exe 1088 backup.exe 1312 backup.exe 1816 backup.exe 1712 backup.exe 612 System Restore.exe 2004 System Restore.exe 468 backup.exe 1964 backup.exe 820 backup.exe 864 backup.exe 1628 backup.exe 536 backup.exe 920 backup.exe 1608 backup.exe 1800 backup.exe 1868 backup.exe 1408 backup.exe 2020 backup.exe 1204 backup.exe 1120 backup.exe 1960 backup.exe 636 update.exe 1544 backup.exe 1804 backup.exe 1536 backup.exe 1972 backup.exe 360 backup.exe 612 backup.exe 1980 backup.exe 1876 backup.exe 768 backup.exe 1496 backup.exe 1528 backup.exe 1196 backup.exe 1976 backup.exe 972 backup.exe 1532 backup.exe 1604 backup.exe 108 data.exe 1748 backup.exe 1160 backup.exe 1408 backup.exe 2020 backup.exe 1204 backup.exe 568 data.exe 1740 backup.exe 1544 backup.exe 1120 backup.exe 1784 backup.exe 1292 backup.exe 860 System Restore.exe 1984 backup.exe 1708 backup.exe 1156 backup.exe 1912 backup.exe 820 backup.exe 1716 System Restore.exe 2012 backup.exe 1732 backup.exe 1600 backup.exe 552 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1948 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 26 PID 964 wrote to memory of 1936 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 27 PID 964 wrote to memory of 1936 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 27 PID 964 wrote to memory of 1936 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 27 PID 964 wrote to memory of 1936 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 27 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1948 wrote to memory of 1088 1948 update.exe 28 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1088 wrote to memory of 1312 1088 backup.exe 29 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 1312 wrote to memory of 1816 1312 backup.exe 30 PID 964 wrote to memory of 1712 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 31 PID 964 wrote to memory of 1712 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 31 PID 964 wrote to memory of 1712 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 31 PID 964 wrote to memory of 1712 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 31 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 1088 wrote to memory of 2004 1088 backup.exe 33 PID 964 wrote to memory of 612 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 32 PID 964 wrote to memory of 612 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 32 PID 964 wrote to memory of 612 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 32 PID 964 wrote to memory of 612 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 32 PID 964 wrote to memory of 468 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 34 PID 964 wrote to memory of 468 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 34 PID 964 wrote to memory of 468 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 34 PID 964 wrote to memory of 468 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 34 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 2004 wrote to memory of 1964 2004 System Restore.exe 35 PID 964 wrote to memory of 820 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 36 PID 964 wrote to memory of 820 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 36 PID 964 wrote to memory of 820 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 36 PID 964 wrote to memory of 820 964 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe 36 PID 1964 wrote to memory of 864 1964 backup.exe 37 PID 1964 wrote to memory of 864 1964 backup.exe 37 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe"C:\Users\Admin\AppData\Local\Temp\79ff10d90690ab10bac30e92522de7e3e32412216848ab11a676bfc20f2840a0.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:964 -
C:\Users\Admin\AppData\Local\Temp\2181159691\update.exeC:\Users\Admin\AppData\Local\Temp\2181159691\update.exe C:\Users\Admin\AppData\Local\Temp\2181159691\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1088 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
-
C:\Program Files\System Restore.exe"C:\Program Files\System Restore.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2004 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:864
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:536 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:920 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1800 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1408
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1120
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:636
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:360 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1160
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:1976
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- System policy modification
PID:988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:2036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1292
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:2172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:2396
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
PID:544
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1964
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1912
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:364
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2148
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:2388
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1196
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1748 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1544 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1568
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1644
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1132
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1928
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2216
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:2404
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1172
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1228
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1168
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2084
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2252
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496 -
C:\Program Files\DVD Maker\de-DE\data.exe"C:\Program Files\DVD Maker\de-DE\data.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:108
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1912
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1116
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1876
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1740
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1288
-
-
-
C:\Program Files\Google\System Restore.exe"C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1716 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1204 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
PID:1848 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:2156
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1060
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:768
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1736
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2092
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2268
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2488
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1528 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1120
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:820
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1200 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1872
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:976
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1796
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1708
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:972
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:2208
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:2364
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1108 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2020 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:280
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1408
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1144
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1988
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2112
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1744
-
-
-
-
C:\Program Files (x86)\Common Files\System Restore.exe"C:\Program Files (x86)\Common Files\System Restore.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:860 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1156 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
PID:1736
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1972
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:592
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:760
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1552
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:468
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2136
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2340
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1372
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2308
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1292 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1732 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:308
-
-
C:\Users\Admin\Desktop\update.exeC:\Users\Admin\Desktop\update.exe C:\Users\Admin\Desktop\6⤵PID:820
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:648
-
-
C:\Users\Admin\Downloads\System Restore.exe"C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\6⤵PID:1184
-
-
C:\Users\Admin\Favorites\data.exeC:\Users\Admin\Favorites\data.exe C:\Users\Admin\Favorites\6⤵PID:2060
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2200
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2356
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1784 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1404
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:2164
-
-
C:\Users\Public\Music\update.exeC:\Users\Public\Music\update.exe C:\Users\Public\Music\6⤵PID:2316
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1188
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:612
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1628
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD524ef5d1d7fa1fb984b09b5f38c7e26f7
SHA17dd8be1cad7bb8872f6a5536b115d7a4762e2513
SHA2567a4c2923b45864a18f4196e475ff0296c70e3c971f9faeb3e47a1b163b0bd539
SHA5125f0c5029128e554e28120f4daf6cbfc9baefcdc81dc0da866d714cfbc90dc6e52332676c7f467f445629776d0dba7b5bae3b9994d13395aedd5f3bc35315d8ae
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5b34239d93228d04604eda4bbc2a033ec
SHA1a13402882da5da676acd0ee241cb69b6b5171be5
SHA25683e2f017f3a448d025f7afaaf2034c5f63faf7e9fa60e64d0163491d8e44889c
SHA5126ee39bfc80f490c98f72436a2843a8086dc6e9609808b5298eed7ec15d1c3ef61c2de6bc9b51efb55b27990bb7e45e261c34aa823bcda193c3a4445e225183ab
-
Filesize
72KB
MD5b34239d93228d04604eda4bbc2a033ec
SHA1a13402882da5da676acd0ee241cb69b6b5171be5
SHA25683e2f017f3a448d025f7afaaf2034c5f63faf7e9fa60e64d0163491d8e44889c
SHA5126ee39bfc80f490c98f72436a2843a8086dc6e9609808b5298eed7ec15d1c3ef61c2de6bc9b51efb55b27990bb7e45e261c34aa823bcda193c3a4445e225183ab
-
Filesize
72KB
MD59c5deef36b8a8e741617ada57fc509d5
SHA14fc47a55b9b2e30cdc2dc9e68bacca89c5846373
SHA256c3860a5311df54924e28d90feecff293298f7dbbf7e8e667539dc747714f1370
SHA512b134345fc0d6c4aaa87db8c1d78f55cb128641d34ff3e8694b844930c337312a6b9139c99147667b1d46359dafc5cc53eaa387ecd43cba26fc5506767bff7446
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
Filesize
72KB
MD50caea20a8e6861ccfa5607bf3f42f88e
SHA169291d6b908ddce948b01d487c3f609150a146bd
SHA2564924c99a020b8ced82dd162df53c277ab3e987b394cf0ee68a536fb3d705d95b
SHA5124e01e9c47d330f2856984c14e569b4d1aced1299e405be73e6fb5ecce541d2f21ce0aa0e45e0b27e392d0e955bb869ab1271642ee1e09874f2bda4ddc7301b6d
-
Filesize
72KB
MD5eec9ef499a234e80a4ac766765061bdb
SHA1410c5e8b4dfeacf4ed6d4736791add059f81acb1
SHA256d4147e4344cd06346481e0f87e1982e00d68016d784d1f00afc106bac528f5f7
SHA5123113da6cd07914e702aa793ee74dbb49c3a929910811b5fd3ef8383eba67515788917344f09fe25b84b88ec153cb9da116b95866fa1d792f3880ef6cf57be8b6
-
Filesize
72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
Filesize
72KB
MD5ed5830f952ff64dede35c725560d07a8
SHA196f8a60ab1c352bd2d6abc1265e7fc975d4b3e99
SHA256443ba136420a8de2d1abaa1639f3c8da8a8e738bedd5b427e4b10ae84881a3f4
SHA512a143cd21994c29cfb77a12c4525a1e1de0eb5134192586b831e4a7fd5c89eff05ac2cdf6b47652b15daa31adcb1ac04e435131c4625a295f9632a0655ec5c4bb
-
Filesize
72KB
MD5ed5830f952ff64dede35c725560d07a8
SHA196f8a60ab1c352bd2d6abc1265e7fc975d4b3e99
SHA256443ba136420a8de2d1abaa1639f3c8da8a8e738bedd5b427e4b10ae84881a3f4
SHA512a143cd21994c29cfb77a12c4525a1e1de0eb5134192586b831e4a7fd5c89eff05ac2cdf6b47652b15daa31adcb1ac04e435131c4625a295f9632a0655ec5c4bb
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD56734d59c67cd1faaeb725695b4fac1b9
SHA1dbe5a6869f390903431ba53533f1af359a8b1ad4
SHA256cad53cfa4eb47ca5b8889c694bf5ae8869afbd33679fdf19a6fcc5e250e8e509
SHA51297019020934ea07ea049351704cfb7e5f531ab318cee0e81ec49709d22ec7795dbf835f1336056f43e8b94968f8f8f0048f086731faf0ac4f6df2609e39f1c3c
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD59377a3884e28e8651557b53771691a75
SHA1f36fcb6ab189baeead4d580e4ec9024b11754c6d
SHA2568a1fb09d2399906dfb90cedbb13126964c6c5862f31fb465d017bb7e3b8d742a
SHA512118c946308dc8c2c4193f19b967367d510dbbce16ab58052db1ac621a1b9c2b03cf2d275847a9fd767e470c3576f7f9ae6ddee5b827caa93a10da9ad947269b1
-
Filesize
72KB
MD524ef5d1d7fa1fb984b09b5f38c7e26f7
SHA17dd8be1cad7bb8872f6a5536b115d7a4762e2513
SHA2567a4c2923b45864a18f4196e475ff0296c70e3c971f9faeb3e47a1b163b0bd539
SHA5125f0c5029128e554e28120f4daf6cbfc9baefcdc81dc0da866d714cfbc90dc6e52332676c7f467f445629776d0dba7b5bae3b9994d13395aedd5f3bc35315d8ae
-
Filesize
72KB
MD524ef5d1d7fa1fb984b09b5f38c7e26f7
SHA17dd8be1cad7bb8872f6a5536b115d7a4762e2513
SHA2567a4c2923b45864a18f4196e475ff0296c70e3c971f9faeb3e47a1b163b0bd539
SHA5125f0c5029128e554e28120f4daf6cbfc9baefcdc81dc0da866d714cfbc90dc6e52332676c7f467f445629776d0dba7b5bae3b9994d13395aedd5f3bc35315d8ae
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5e3cf9a0e2d8fa9ff670a861cd79980b2
SHA1195df7de50aa42e51d2e349f877531a073988f7e
SHA25643b68d770a73f25fb811cfee646e6df3a0db9492654a58dce5cc1cc22e98358b
SHA51254974eb16b0c825603ad3ca188eed1731ec3be78517dff6114e2493ba5b667c01b8cedce39b2ce836409c9a97afe7c9e113db88ae14599cac0446b8364f2ed68
-
Filesize
72KB
MD5b34239d93228d04604eda4bbc2a033ec
SHA1a13402882da5da676acd0ee241cb69b6b5171be5
SHA25683e2f017f3a448d025f7afaaf2034c5f63faf7e9fa60e64d0163491d8e44889c
SHA5126ee39bfc80f490c98f72436a2843a8086dc6e9609808b5298eed7ec15d1c3ef61c2de6bc9b51efb55b27990bb7e45e261c34aa823bcda193c3a4445e225183ab
-
Filesize
72KB
MD5b34239d93228d04604eda4bbc2a033ec
SHA1a13402882da5da676acd0ee241cb69b6b5171be5
SHA25683e2f017f3a448d025f7afaaf2034c5f63faf7e9fa60e64d0163491d8e44889c
SHA5126ee39bfc80f490c98f72436a2843a8086dc6e9609808b5298eed7ec15d1c3ef61c2de6bc9b51efb55b27990bb7e45e261c34aa823bcda193c3a4445e225183ab
-
Filesize
72KB
MD5b34239d93228d04604eda4bbc2a033ec
SHA1a13402882da5da676acd0ee241cb69b6b5171be5
SHA25683e2f017f3a448d025f7afaaf2034c5f63faf7e9fa60e64d0163491d8e44889c
SHA5126ee39bfc80f490c98f72436a2843a8086dc6e9609808b5298eed7ec15d1c3ef61c2de6bc9b51efb55b27990bb7e45e261c34aa823bcda193c3a4445e225183ab
-
Filesize
72KB
MD5b34239d93228d04604eda4bbc2a033ec
SHA1a13402882da5da676acd0ee241cb69b6b5171be5
SHA25683e2f017f3a448d025f7afaaf2034c5f63faf7e9fa60e64d0163491d8e44889c
SHA5126ee39bfc80f490c98f72436a2843a8086dc6e9609808b5298eed7ec15d1c3ef61c2de6bc9b51efb55b27990bb7e45e261c34aa823bcda193c3a4445e225183ab
-
Filesize
72KB
MD59c5deef36b8a8e741617ada57fc509d5
SHA14fc47a55b9b2e30cdc2dc9e68bacca89c5846373
SHA256c3860a5311df54924e28d90feecff293298f7dbbf7e8e667539dc747714f1370
SHA512b134345fc0d6c4aaa87db8c1d78f55cb128641d34ff3e8694b844930c337312a6b9139c99147667b1d46359dafc5cc53eaa387ecd43cba26fc5506767bff7446
-
Filesize
72KB
MD59c5deef36b8a8e741617ada57fc509d5
SHA14fc47a55b9b2e30cdc2dc9e68bacca89c5846373
SHA256c3860a5311df54924e28d90feecff293298f7dbbf7e8e667539dc747714f1370
SHA512b134345fc0d6c4aaa87db8c1d78f55cb128641d34ff3e8694b844930c337312a6b9139c99147667b1d46359dafc5cc53eaa387ecd43cba26fc5506767bff7446
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
Filesize
72KB
MD50caea20a8e6861ccfa5607bf3f42f88e
SHA169291d6b908ddce948b01d487c3f609150a146bd
SHA2564924c99a020b8ced82dd162df53c277ab3e987b394cf0ee68a536fb3d705d95b
SHA5124e01e9c47d330f2856984c14e569b4d1aced1299e405be73e6fb5ecce541d2f21ce0aa0e45e0b27e392d0e955bb869ab1271642ee1e09874f2bda4ddc7301b6d
-
Filesize
72KB
MD50caea20a8e6861ccfa5607bf3f42f88e
SHA169291d6b908ddce948b01d487c3f609150a146bd
SHA2564924c99a020b8ced82dd162df53c277ab3e987b394cf0ee68a536fb3d705d95b
SHA5124e01e9c47d330f2856984c14e569b4d1aced1299e405be73e6fb5ecce541d2f21ce0aa0e45e0b27e392d0e955bb869ab1271642ee1e09874f2bda4ddc7301b6d
-
Filesize
72KB
MD5eec9ef499a234e80a4ac766765061bdb
SHA1410c5e8b4dfeacf4ed6d4736791add059f81acb1
SHA256d4147e4344cd06346481e0f87e1982e00d68016d784d1f00afc106bac528f5f7
SHA5123113da6cd07914e702aa793ee74dbb49c3a929910811b5fd3ef8383eba67515788917344f09fe25b84b88ec153cb9da116b95866fa1d792f3880ef6cf57be8b6
-
Filesize
72KB
MD5eec9ef499a234e80a4ac766765061bdb
SHA1410c5e8b4dfeacf4ed6d4736791add059f81acb1
SHA256d4147e4344cd06346481e0f87e1982e00d68016d784d1f00afc106bac528f5f7
SHA5123113da6cd07914e702aa793ee74dbb49c3a929910811b5fd3ef8383eba67515788917344f09fe25b84b88ec153cb9da116b95866fa1d792f3880ef6cf57be8b6
-
Filesize
72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4
-
Filesize
72KB
MD526e30f10f67ebb65ebf38225651aae5f
SHA139336982d12c8dfeef4c94754fb0f6bac1063af9
SHA2567537adbd06286905e6172072eb6b73f65b008d923e03b7e95c18219f3c8d23d6
SHA512fe57d3f542522a95d74db756b727c6992ce6a5abc07a2bde41a1ff029593dba6097eaddf054ee1e7bb265f32382f13439da145c0ed8477b64579f4cd32897bf4