Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
Resource
win10v2004-20221111-en
General
-
Target
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
-
Size
72KB
-
MD5
089486ab489ab4f97ce70cba78a50961
-
SHA1
c86bcc5b33c46817d459523cd84a81675d1be81c
-
SHA256
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e
-
SHA512
5d462d7449e6de7910fa476c5688dbb2718531a550d48c0ebf90012a3bc9dd1b4cfdb9e018620c2208019213db5cb34b35b194ab1bedd43a9d2b708c2045c2b6
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2D:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 3176 backup.exe 2956 backup.exe 4352 data.exe 3080 backup.exe 3392 backup.exe 1200 backup.exe 4780 backup.exe 1936 backup.exe 320 backup.exe 3060 backup.exe 4388 backup.exe 1032 backup.exe 4364 data.exe 4368 data.exe 4904 backup.exe 3528 data.exe 4424 backup.exe 3812 backup.exe 1632 backup.exe 372 backup.exe 524 backup.exe 4784 backup.exe 1908 backup.exe 1876 backup.exe 3568 backup.exe 1292 backup.exe 3612 backup.exe 2804 backup.exe 2144 System Restore.exe 2260 backup.exe 1748 backup.exe 2760 backup.exe 1560 backup.exe 2168 backup.exe 2236 backup.exe 3268 backup.exe 3156 backup.exe 4000 backup.exe 5048 backup.exe 1468 backup.exe 3372 backup.exe 4352 backup.exe 2788 backup.exe 632 update.exe 2644 backup.exe 3736 backup.exe 1644 backup.exe 3556 backup.exe 2104 backup.exe 5072 update.exe 1476 backup.exe 3280 backup.exe 4152 backup.exe 4396 backup.exe 668 backup.exe 4308 backup.exe 4296 backup.exe 3224 backup.exe 2884 backup.exe 2892 backup.exe 1992 backup.exe 2568 backup.exe 2904 backup.exe 2944 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ado\es-ES\update.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\DESIGNER\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe data.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe data.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office 15\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe data.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe data.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\update.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\Office16\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\data.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\update.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe System Restore.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\backup.exe backup.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\encapsulation\backup.exe backup.exe File opened for modification C:\Windows\apppatch\AppPatch64\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\appcompat\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\backup.exe backup.exe File opened for modification C:\Windows\apppatch\backup.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\Telemetry\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppReadiness\backup.exe backup.exe File opened for modification C:\Windows\appcompat\Programs\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 3176 backup.exe 2956 backup.exe 4352 data.exe 3080 backup.exe 3392 backup.exe 1200 backup.exe 4780 backup.exe 1936 backup.exe 320 backup.exe 3060 backup.exe 4388 backup.exe 1032 backup.exe 4364 data.exe 4368 data.exe 4904 backup.exe 3528 data.exe 4424 backup.exe 3812 backup.exe 1632 backup.exe 372 backup.exe 524 backup.exe 4784 backup.exe 1876 backup.exe 1908 backup.exe 3568 backup.exe 1292 backup.exe 3612 backup.exe 2804 backup.exe 1748 backup.exe 2260 backup.exe 2144 System Restore.exe 2760 backup.exe 1560 backup.exe 2168 backup.exe 3268 backup.exe 2236 backup.exe 3156 backup.exe 4000 backup.exe 5048 backup.exe 1468 backup.exe 3372 backup.exe 4352 backup.exe 2788 backup.exe 632 update.exe 2644 backup.exe 1644 backup.exe 3736 backup.exe 3556 backup.exe 2104 backup.exe 5072 update.exe 3280 backup.exe 4396 backup.exe 668 backup.exe 1476 backup.exe 4152 backup.exe 4308 backup.exe 4296 backup.exe 2884 backup.exe 3224 backup.exe 2892 backup.exe 2568 backup.exe 1992 backup.exe 2904 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4628 wrote to memory of 3176 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 84 PID 4628 wrote to memory of 3176 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 84 PID 4628 wrote to memory of 3176 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 84 PID 4628 wrote to memory of 2956 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 85 PID 4628 wrote to memory of 2956 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 85 PID 4628 wrote to memory of 2956 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 85 PID 4628 wrote to memory of 4352 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 86 PID 4628 wrote to memory of 4352 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 86 PID 4628 wrote to memory of 4352 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 86 PID 4628 wrote to memory of 3080 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 87 PID 4628 wrote to memory of 3080 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 87 PID 4628 wrote to memory of 3080 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 87 PID 4628 wrote to memory of 3392 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 88 PID 4628 wrote to memory of 3392 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 88 PID 4628 wrote to memory of 3392 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 88 PID 4628 wrote to memory of 1200 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 89 PID 4628 wrote to memory of 1200 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 89 PID 4628 wrote to memory of 1200 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 89 PID 3176 wrote to memory of 4780 3176 backup.exe 90 PID 3176 wrote to memory of 4780 3176 backup.exe 90 PID 3176 wrote to memory of 4780 3176 backup.exe 90 PID 4780 wrote to memory of 1936 4780 backup.exe 91 PID 4780 wrote to memory of 1936 4780 backup.exe 91 PID 4780 wrote to memory of 1936 4780 backup.exe 91 PID 4628 wrote to memory of 320 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 92 PID 4628 wrote to memory of 320 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 92 PID 4628 wrote to memory of 320 4628 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 92 PID 4780 wrote to memory of 3060 4780 backup.exe 93 PID 4780 wrote to memory of 3060 4780 backup.exe 93 PID 4780 wrote to memory of 3060 4780 backup.exe 93 PID 4780 wrote to memory of 4388 4780 backup.exe 94 PID 4780 wrote to memory of 4388 4780 backup.exe 94 PID 4780 wrote to memory of 4388 4780 backup.exe 94 PID 4388 wrote to memory of 1032 4388 backup.exe 95 PID 4388 wrote to memory of 1032 4388 backup.exe 95 PID 4388 wrote to memory of 1032 4388 backup.exe 95 PID 1032 wrote to memory of 4364 1032 backup.exe 96 PID 1032 wrote to memory of 4364 1032 backup.exe 96 PID 1032 wrote to memory of 4364 1032 backup.exe 96 PID 4388 wrote to memory of 4368 4388 backup.exe 97 PID 4388 wrote to memory of 4368 4388 backup.exe 97 PID 4388 wrote to memory of 4368 4388 backup.exe 97 PID 4368 wrote to memory of 4904 4368 data.exe 98 PID 4368 wrote to memory of 4904 4368 data.exe 98 PID 4368 wrote to memory of 4904 4368 data.exe 98 PID 4368 wrote to memory of 3528 4368 data.exe 99 PID 4368 wrote to memory of 3528 4368 data.exe 99 PID 4368 wrote to memory of 3528 4368 data.exe 99 PID 3528 wrote to memory of 4424 3528 data.exe 100 PID 3528 wrote to memory of 4424 3528 data.exe 100 PID 3528 wrote to memory of 4424 3528 data.exe 100 PID 3528 wrote to memory of 3812 3528 data.exe 101 PID 3528 wrote to memory of 3812 3528 data.exe 101 PID 3528 wrote to memory of 3812 3528 data.exe 101 PID 4388 wrote to memory of 1632 4388 backup.exe 104 PID 4388 wrote to memory of 1632 4388 backup.exe 104 PID 4388 wrote to memory of 1632 4388 backup.exe 104 PID 4368 wrote to memory of 372 4368 data.exe 102 PID 4368 wrote to memory of 372 4368 data.exe 102 PID 4368 wrote to memory of 372 4368 data.exe 102 PID 4780 wrote to memory of 524 4780 backup.exe 103 PID 4780 wrote to memory of 524 4780 backup.exe 103 PID 4780 wrote to memory of 524 4780 backup.exe 103 PID 3528 wrote to memory of 4784 3528 data.exe 105 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe"C:\Users\Admin\AppData\Local\Temp\e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\1245620864\backup.exeC:\Users\Admin\AppData\Local\Temp\1245620864\backup.exe C:\Users\Admin\AppData\Local\Temp\1245620864\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files\7-Zip\Lang\data.exe"C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4364
-
-
-
C:\Program Files\Common Files\data.exe"C:\Program Files\Common Files\data.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4904
-
-
C:\Program Files\Common Files\microsoft shared\data.exe"C:\Program Files\Common Files\microsoft shared\data.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4424
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3812 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2260
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2168
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2644
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4152
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2892
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵PID:1908
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4280
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3968
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:932
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
PID:2752
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵PID:3224
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵PID:4964
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵PID:1924
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4784 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3612
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2236
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:632
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3280
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4308
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:744 -
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3372
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4880
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4596
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
PID:1792
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- System policy modification
PID:2468 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵PID:2884
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\update.exe"C:\Program Files\Common Files\microsoft shared\Triedit\update.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵PID:2652
-
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵PID:2748
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:372
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3568 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4000
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4352
-
-
C:\Program Files\Common Files\System\ado\es-ES\update.exe"C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2568
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- System policy modification
PID:3300
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:2392
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4252
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3024
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:756
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:3920
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3300
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
PID:3736
-
-
C:\Program Files\Common Files\System\msadc\System Restore.exe"C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:3124
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1292 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2804 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1560 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3736
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4396
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2884
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- System policy modification
PID:2840
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Disables RegEdit via registry modification
PID:3052 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1684 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2060
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Executes dropped EXE
- System policy modification
PID:2944
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5048 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3556
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2104
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3224
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4720
-
-
C:\Program Files\Internet Explorer\images\update.exe"C:\Program Files\Internet Explorer\images\update.exe" C:\Program Files\Internet Explorer\images\6⤵
- Disables RegEdit via registry modification
PID:2612
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1708
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4988
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
- System policy modification
PID:1304
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2932 -
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:2988 -
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵PID:1928
-
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Drops file in Program Files directory
PID:3320 -
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\8⤵PID:4744
-
-
C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\8⤵PID:1048
-
-
-
C:\Program Files\Java\jdk1.8.0_66\include\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\7⤵PID:3552
-
C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\8⤵PID:4860
-
-
-
C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe"C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\7⤵PID:4936
-
C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\8⤵PID:3556
-
-
-
-
C:\Program Files\Java\jre1.8.0_66\backup.exe"C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1112 -
C:\Program Files\Java\jre1.8.0_66\bin\backup.exe"C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\7⤵PID:2420
-
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:4072 -
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵PID:3564
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵PID:1180
-
-
-
C:\Program Files\Microsoft Office 15\backup.exe"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\5⤵PID:896
-
C:\Program Files\Microsoft Office 15\ClientX64\update.exe"C:\Program Files\Microsoft Office 15\ClientX64\update.exe" C:\Program Files\Microsoft Office 15\ClientX64\6⤵PID:2012
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:524 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2144 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3268
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:668 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:3572
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
- Disables RegEdit via registry modification
PID:4732
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
PID:3272
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1312 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵PID:2776
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3980 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\9⤵PID:668
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵PID:3220
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵PID:3276
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵PID:3788
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:4140 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3716 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:3500
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3956
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4368 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:2168 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\10⤵
- System policy modification
PID:4700
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\10⤵PID:2344
-
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵
- System policy modification
PID:2096 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\8⤵PID:1536
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:4328 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:316 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3080
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵PID:1648
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
- Modifies visibility of file extensions in Explorer
PID:3948
-
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4720 -
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵PID:4152
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵PID:4540
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵PID:3304
-
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵
- Disables RegEdit via registry modification
PID:1844 -
C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\7⤵PID:4588
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:2744 -
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\7⤵PID:4084
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2888
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:4092
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Disables RegEdit via registry modification
PID:4336 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1904
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:4280
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:3776
-
-
-
C:\Program Files (x86)\Microsoft\backup.exe"C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\5⤵PID:2084
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4296
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
PID:3576
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:3268
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2916
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1476
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1608
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Disables RegEdit via registry modification
PID:1764
-
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵PID:312
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1272 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Modifies visibility of file extensions in Explorer
PID:1564
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:2416
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3328
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
- System policy modification
PID:4784
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵PID:4524
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
PID:4696 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1824
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Drops file in Windows directory
- System policy modification
PID:3540 -
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:1292 -
C:\Windows\appcompat\appraiser\Telemetry\backup.exeC:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵
- Modifies visibility of file extensions in Explorer
PID:4000
-
-
-
C:\Windows\appcompat\encapsulation\backup.exeC:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\6⤵
- Modifies visibility of file extensions in Explorer
PID:3576
-
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵PID:2800
-
-
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
PID:2804 -
C:\Windows\apppatch\AppPatch64\backup.exeC:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\6⤵PID:176
-
-
C:\Windows\apppatch\Custom\backup.exeC:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\6⤵PID:4760
-
-
-
C:\Windows\AppReadiness\backup.exeC:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\5⤵PID:1812
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1304
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4352
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:320
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD511d46e1386e8e8a79406d158969e1e75
SHA12c7a4963c5c57e2ed497e79e47516f49b04bdbf4
SHA25665e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209
SHA512a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2
-
Filesize
72KB
MD511d46e1386e8e8a79406d158969e1e75
SHA12c7a4963c5c57e2ed497e79e47516f49b04bdbf4
SHA25665e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209
SHA512a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2
-
Filesize
72KB
MD51affb0f3368dd26fbe0079af0d6c0d0d
SHA1655a4af03c8e3d6dd5fa8065ef57b6fca01679a5
SHA256d0736721680e067f2221b48ff9fa74add19a79302c8d580c8539f082c42123b0
SHA51298313b5c36987bae280b6967d9b51b5ef35062d470d63c8ab6b8c449ae458ab5f74983bbe5c5a5571b96ecaa06e8225bb4b7f415f286b720c74c10450887de86
-
Filesize
72KB
MD51affb0f3368dd26fbe0079af0d6c0d0d
SHA1655a4af03c8e3d6dd5fa8065ef57b6fca01679a5
SHA256d0736721680e067f2221b48ff9fa74add19a79302c8d580c8539f082c42123b0
SHA51298313b5c36987bae280b6967d9b51b5ef35062d470d63c8ab6b8c449ae458ab5f74983bbe5c5a5571b96ecaa06e8225bb4b7f415f286b720c74c10450887de86
-
Filesize
72KB
MD570419d478796e00f90d573976217c32e
SHA1f6c11d393e841a986c581a3e756f92ddf56b5cb7
SHA256a0a19a0868a22402020f60a6b7c8232239819e32a68718f513d7187094019a81
SHA5122dd66a8edd50970430ab489fd1b0a861bb3ad57910dd31a700f6aae17e427c3e902bb8a128f9df895022f2e0a2e83fb1fde16e17ca59d3c8cbf6ae8f3f75be4f
-
Filesize
72KB
MD570419d478796e00f90d573976217c32e
SHA1f6c11d393e841a986c581a3e756f92ddf56b5cb7
SHA256a0a19a0868a22402020f60a6b7c8232239819e32a68718f513d7187094019a81
SHA5122dd66a8edd50970430ab489fd1b0a861bb3ad57910dd31a700f6aae17e427c3e902bb8a128f9df895022f2e0a2e83fb1fde16e17ca59d3c8cbf6ae8f3f75be4f
-
Filesize
72KB
MD515fbdd7841579f86c5944e729777bee7
SHA10aabc260c4a6fe63751baaf3a2d21f67f52770a6
SHA256bc175ac0bda13f03387e19ca7e676351aeca458ccb114bef9293673b6339525f
SHA512a3420fbd4a9a7fae8b034c4b11c4009b5f990f85a49c23e0353ab0cc02671102215f747f80a061ef62084572d2b5332c6fbe195f8a8ef263eaf36bed00105dd3
-
Filesize
72KB
MD515fbdd7841579f86c5944e729777bee7
SHA10aabc260c4a6fe63751baaf3a2d21f67f52770a6
SHA256bc175ac0bda13f03387e19ca7e676351aeca458ccb114bef9293673b6339525f
SHA512a3420fbd4a9a7fae8b034c4b11c4009b5f990f85a49c23e0353ab0cc02671102215f747f80a061ef62084572d2b5332c6fbe195f8a8ef263eaf36bed00105dd3
-
Filesize
72KB
MD59e56078fd77241c368ba30a0ae556e2f
SHA1b3b4982b7dc541c3c381cebe2bebec977bc9a539
SHA25692d2ecc9f27369ffb308e0a19abc99a5f32fdc64d09fc55fbb9933a15709b44e
SHA5127583f850b4dc529ef05b6a8cdbce1544cc399c75cd9452bb22fa4beb25409294d83b53ee11caefd88e74d2f552d2800fcc7ab7401537d19b01050fea9b5edf06
-
Filesize
72KB
MD59e56078fd77241c368ba30a0ae556e2f
SHA1b3b4982b7dc541c3c381cebe2bebec977bc9a539
SHA25692d2ecc9f27369ffb308e0a19abc99a5f32fdc64d09fc55fbb9933a15709b44e
SHA5127583f850b4dc529ef05b6a8cdbce1544cc399c75cd9452bb22fa4beb25409294d83b53ee11caefd88e74d2f552d2800fcc7ab7401537d19b01050fea9b5edf06
-
Filesize
72KB
MD5c2d7cfe479e889f3f238ef792de7a7e5
SHA150b2742c875c93fd40c6e388d209134699c37abf
SHA2567483ed7fd8f8e2f58770c674e145c6610f7fd4fddc9fb3e3b5850dbdfc4981ec
SHA512821732856bdc4403b891f0a5fd636f54ba71e72f4faf34aa00d53461e61f200fe68d3669152501ec8a33c659acd75ffd283875d214d230dd083bd30bc273385d
-
Filesize
72KB
MD5c2d7cfe479e889f3f238ef792de7a7e5
SHA150b2742c875c93fd40c6e388d209134699c37abf
SHA2567483ed7fd8f8e2f58770c674e145c6610f7fd4fddc9fb3e3b5850dbdfc4981ec
SHA512821732856bdc4403b891f0a5fd636f54ba71e72f4faf34aa00d53461e61f200fe68d3669152501ec8a33c659acd75ffd283875d214d230dd083bd30bc273385d
-
Filesize
72KB
MD533f89961ca785056e63cbc0306a9507f
SHA1628b436b332bd72d54c5f343caaa2f6456ac0618
SHA2567330fba249b74011f1e46db4556e0009eb4d3394f82f0583ec49b54e24cab0cb
SHA5129466b233409dc2eff043b729e390668e07fa348001f28b1e57dcc017b8045e3dee53ac3f486899adff7c5940b84feecfa58ee89c0ffc6a458f3ab477f26436ff
-
Filesize
72KB
MD533f89961ca785056e63cbc0306a9507f
SHA1628b436b332bd72d54c5f343caaa2f6456ac0618
SHA2567330fba249b74011f1e46db4556e0009eb4d3394f82f0583ec49b54e24cab0cb
SHA5129466b233409dc2eff043b729e390668e07fa348001f28b1e57dcc017b8045e3dee53ac3f486899adff7c5940b84feecfa58ee89c0ffc6a458f3ab477f26436ff
-
Filesize
72KB
MD52a8f34236ba23d29d94c88ae53d7f997
SHA1fa6d307a141c8a8eadde894118ca6e66ee317aaf
SHA2561cfb1484d5b43e5be63151a3bd828799d5f549d31523b9588cf806ec7515baf7
SHA512bab0b251e5a4e1748b386f217a9adde92e75c2c06ffff5ecd32ca37c01c43cf7370a10bcb21867883cf887b1878ed89f9ff22e21c670283150ff42b2c26c132c
-
Filesize
72KB
MD52a8f34236ba23d29d94c88ae53d7f997
SHA1fa6d307a141c8a8eadde894118ca6e66ee317aaf
SHA2561cfb1484d5b43e5be63151a3bd828799d5f549d31523b9588cf806ec7515baf7
SHA512bab0b251e5a4e1748b386f217a9adde92e75c2c06ffff5ecd32ca37c01c43cf7370a10bcb21867883cf887b1878ed89f9ff22e21c670283150ff42b2c26c132c
-
Filesize
72KB
MD59c1fb5875d2b7a3c51a3fbfa34d84437
SHA103e3c8477d1f059a6bbaeb5d848bfa5965e90bfc
SHA256e723cf8b9950d139f1969f04e0f9edcf9ec8e27fed4e0fbd8f06a30c69fbdf9f
SHA5127ac69e81c285f8a7590787498b3e0e83cf1b119e69b78d4e344848e8a4b873cd698c7476ea0f188f7b323f9d81afc5d347d0b9c943b7722f25926f74a29e4340
-
Filesize
72KB
MD59c1fb5875d2b7a3c51a3fbfa34d84437
SHA103e3c8477d1f059a6bbaeb5d848bfa5965e90bfc
SHA256e723cf8b9950d139f1969f04e0f9edcf9ec8e27fed4e0fbd8f06a30c69fbdf9f
SHA5127ac69e81c285f8a7590787498b3e0e83cf1b119e69b78d4e344848e8a4b873cd698c7476ea0f188f7b323f9d81afc5d347d0b9c943b7722f25926f74a29e4340
-
Filesize
72KB
MD59e5ca6b31678bb4b0ab62b7874def36f
SHA169846a3542da5c885965cd0cab794094e376f212
SHA256ab471f0f6a1a37a31f13d3549120acadd46dd45c205297fc89ca6f8569985bb2
SHA5129d6031b7e3ad9405e45bdc43b61688519230eb42240d07ed8c8140870d1f6fc42c8065b02edb751c45eb222cfa3c5d0753949fe653576cadc34fef790f2b8a49
-
Filesize
72KB
MD59e5ca6b31678bb4b0ab62b7874def36f
SHA169846a3542da5c885965cd0cab794094e376f212
SHA256ab471f0f6a1a37a31f13d3549120acadd46dd45c205297fc89ca6f8569985bb2
SHA5129d6031b7e3ad9405e45bdc43b61688519230eb42240d07ed8c8140870d1f6fc42c8065b02edb751c45eb222cfa3c5d0753949fe653576cadc34fef790f2b8a49
-
Filesize
72KB
MD5929046faae79669e01861a949f0f00b4
SHA190b2d8ed0e74c8d5d98389187a2f3966b4c38eaf
SHA256fc51c1d409d5facdc38f60bcc0db51b68e40adec7efb908d6f8d11799de91896
SHA51200ea226b62126048a3c6c200baa39063ccc972689dd9ee8cea9fa6978dd7f7872d706a4b209458c9a931d8f45b9e5d4ae5b3e8bafe80ce401f5d4c3f41e9f008
-
Filesize
72KB
MD5929046faae79669e01861a949f0f00b4
SHA190b2d8ed0e74c8d5d98389187a2f3966b4c38eaf
SHA256fc51c1d409d5facdc38f60bcc0db51b68e40adec7efb908d6f8d11799de91896
SHA51200ea226b62126048a3c6c200baa39063ccc972689dd9ee8cea9fa6978dd7f7872d706a4b209458c9a931d8f45b9e5d4ae5b3e8bafe80ce401f5d4c3f41e9f008
-
Filesize
72KB
MD55c4a76a75d54b7612f0dea0e2c9f1c3b
SHA1b1c1d4d81de1875b4774ba63e8bb6c96ccb46780
SHA2564b569a06f8e0f13c2d34d9cfe352b75700c1619fbe27ac90b56b0b399fcb22f7
SHA5128b6fcddae4ced44c1b8896b4a7f21c3e20eeb6f2d28adee745052fba1684313dd9e51304dd17efeb20011016765f351e1d6bad01230574c194d2180c78471fd3
-
Filesize
72KB
MD55c4a76a75d54b7612f0dea0e2c9f1c3b
SHA1b1c1d4d81de1875b4774ba63e8bb6c96ccb46780
SHA2564b569a06f8e0f13c2d34d9cfe352b75700c1619fbe27ac90b56b0b399fcb22f7
SHA5128b6fcddae4ced44c1b8896b4a7f21c3e20eeb6f2d28adee745052fba1684313dd9e51304dd17efeb20011016765f351e1d6bad01230574c194d2180c78471fd3
-
Filesize
72KB
MD5c6c63d520ed354300f460e7b35225f0e
SHA1aff72e0c55ebdaccd8b4ba304770b43248f57984
SHA25635d99710ee8169bcd6eabf18ece7a09d9833065eee0dfd996d49e7d3e8b84791
SHA512b25ef7aa82f23bb9d24d94797ef44488424d389101198ef1cea8613eaa3bd3334243d016460abe9825142183d219a60436c223de639c4fe8bbcdbddc77db89a2
-
Filesize
72KB
MD5c6c63d520ed354300f460e7b35225f0e
SHA1aff72e0c55ebdaccd8b4ba304770b43248f57984
SHA25635d99710ee8169bcd6eabf18ece7a09d9833065eee0dfd996d49e7d3e8b84791
SHA512b25ef7aa82f23bb9d24d94797ef44488424d389101198ef1cea8613eaa3bd3334243d016460abe9825142183d219a60436c223de639c4fe8bbcdbddc77db89a2
-
Filesize
72KB
MD52ac4c35f764b6d0ffa40a948734831ef
SHA1745f765abf41925e22eef6cb8619d3632bae1750
SHA25623f7dc8d7ec07542f8e7c606d317e5e2c300d36a955a97396dc54b1854efaf11
SHA5121ec1e94a146b72a0f992fb9a2cd3e275ebbdad9e5d888545bfa6c2364fc9b9d981670bbe9a8bccd1294c3375d925014f05e23642e1c548eb1eb96abcc791ae69
-
Filesize
72KB
MD52ac4c35f764b6d0ffa40a948734831ef
SHA1745f765abf41925e22eef6cb8619d3632bae1750
SHA25623f7dc8d7ec07542f8e7c606d317e5e2c300d36a955a97396dc54b1854efaf11
SHA5121ec1e94a146b72a0f992fb9a2cd3e275ebbdad9e5d888545bfa6c2364fc9b9d981670bbe9a8bccd1294c3375d925014f05e23642e1c548eb1eb96abcc791ae69
-
Filesize
72KB
MD55899db2fbea4fe9f2e45dcd6b854662f
SHA14c6ec309da912d25797521cb48b2d15ac565cc4f
SHA256d27dc1c3b1043b6029929b3b8fb016e7d0f40e9858e7a8debf3c864e1d235b38
SHA512df7da4fdd2827a5db2f29231dcf20164a24075c72bfa36a295aca6e2f5bfc61cbacc53ade1520d5f51a3b47eabc6e6a8d4026522cbaf130139ecea793e13cf5d
-
Filesize
72KB
MD55899db2fbea4fe9f2e45dcd6b854662f
SHA14c6ec309da912d25797521cb48b2d15ac565cc4f
SHA256d27dc1c3b1043b6029929b3b8fb016e7d0f40e9858e7a8debf3c864e1d235b38
SHA512df7da4fdd2827a5db2f29231dcf20164a24075c72bfa36a295aca6e2f5bfc61cbacc53ade1520d5f51a3b47eabc6e6a8d4026522cbaf130139ecea793e13cf5d
-
Filesize
72KB
MD5edad129d222891bde093d222913596e9
SHA162f034c931e99f824903d1c81073268312aa44f1
SHA25638fe19b07272f7239c23630e3483dfa4c4e535fe260ac12551f421451fc70f83
SHA5127328782575d49d07f0a00fdbf1a31764886e88c9a8456cde3b4db566ba014c3e48609ef56e742b67ba7e44db6648da1d3d8efabeb8b55b5cba0762f550ae088b
-
Filesize
72KB
MD5edad129d222891bde093d222913596e9
SHA162f034c931e99f824903d1c81073268312aa44f1
SHA25638fe19b07272f7239c23630e3483dfa4c4e535fe260ac12551f421451fc70f83
SHA5127328782575d49d07f0a00fdbf1a31764886e88c9a8456cde3b4db566ba014c3e48609ef56e742b67ba7e44db6648da1d3d8efabeb8b55b5cba0762f550ae088b
-
Filesize
72KB
MD513df5592ade91f1d9c1db56f4715f85b
SHA1b58813266fd3b383799422d54e68227dbf88e640
SHA2561343441676da85f5cfff3f07a66824b6aa6e482563582c936d9c91216a1732f2
SHA512a7155945abb0b4f68c7e56ad6ec97f26c2ab1b2a81e167c75ebd1a5c533d277a423f453e6949aba03c8f0c503387364b6f2b533253964c616a7e0abd5b2fbcce
-
Filesize
72KB
MD513df5592ade91f1d9c1db56f4715f85b
SHA1b58813266fd3b383799422d54e68227dbf88e640
SHA2561343441676da85f5cfff3f07a66824b6aa6e482563582c936d9c91216a1732f2
SHA512a7155945abb0b4f68c7e56ad6ec97f26c2ab1b2a81e167c75ebd1a5c533d277a423f453e6949aba03c8f0c503387364b6f2b533253964c616a7e0abd5b2fbcce
-
Filesize
72KB
MD5a10ace24b94f6a8a51c46d021fceb10e
SHA1b85c73f31a59e5b2c62179b90e7568b34a6672e9
SHA256057ac2facf41988bbd6e908b8b7ef3bbcc780bbc2a60052d2f4dd5d40c4e9a15
SHA512c1565747b04cbaaf801c83f60ee0cbed2d5985e4bb8a08c4b0811d3e13d06744af103dae32e59da298666da00d46c5f3d0f1e7dc46c2b80483d39475c4e1ac2b
-
Filesize
72KB
MD5a10ace24b94f6a8a51c46d021fceb10e
SHA1b85c73f31a59e5b2c62179b90e7568b34a6672e9
SHA256057ac2facf41988bbd6e908b8b7ef3bbcc780bbc2a60052d2f4dd5d40c4e9a15
SHA512c1565747b04cbaaf801c83f60ee0cbed2d5985e4bb8a08c4b0811d3e13d06744af103dae32e59da298666da00d46c5f3d0f1e7dc46c2b80483d39475c4e1ac2b
-
Filesize
72KB
MD5058eef97c8b7a7ef6987d7a747f5dc69
SHA1c08eb2522c217a9e6110c86ceb42c32852be3d98
SHA25605fe4cbc0e7e986b74e2d9bb2ca138c93745f8490c4f9558297774c5c567b072
SHA5124904a10eebecedbbd6f8886a4d1f5cdd1ce31cdee997b573d4a8b551ad76158afc9fb21ec2cc441ccbb4167d0608550ee7dd970e06e5f81a515cbcbf3cfeebe7
-
Filesize
72KB
MD5058eef97c8b7a7ef6987d7a747f5dc69
SHA1c08eb2522c217a9e6110c86ceb42c32852be3d98
SHA25605fe4cbc0e7e986b74e2d9bb2ca138c93745f8490c4f9558297774c5c567b072
SHA5124904a10eebecedbbd6f8886a4d1f5cdd1ce31cdee997b573d4a8b551ad76158afc9fb21ec2cc441ccbb4167d0608550ee7dd970e06e5f81a515cbcbf3cfeebe7
-
Filesize
72KB
MD59b0f39b5aba61a72acdb0aa626305be3
SHA1a2e59f769dc62f7913604a2e6eab619ff4eb6518
SHA256eb8a158fee6795d27269bacdd8490a9c3d5a5b7119432aac63736a18ff78ef83
SHA512050dd0ce40a9296b4327997444acc74c49415f33d3011bde814f6020f0bc5412ed2b48881d14294210c88b712a5fe3aa86b515214dbdd73609a47f703eaceecf
-
Filesize
72KB
MD59b0f39b5aba61a72acdb0aa626305be3
SHA1a2e59f769dc62f7913604a2e6eab619ff4eb6518
SHA256eb8a158fee6795d27269bacdd8490a9c3d5a5b7119432aac63736a18ff78ef83
SHA512050dd0ce40a9296b4327997444acc74c49415f33d3011bde814f6020f0bc5412ed2b48881d14294210c88b712a5fe3aa86b515214dbdd73609a47f703eaceecf
-
Filesize
72KB
MD50dcd5abe50cf2cd1ba15f212897fc5c5
SHA14de7c581909603cd2815799a14415cf34b8cac90
SHA256605a5df82e757dc79b4bdcba0634df1590f89c2c0397b3073b811c6325623fed
SHA5122530a80cf49ebbaa7a8770fd5857260704b414042a60a93c7385e32e83f371bd4b22e9f5ed03867dc3d5af4e2190f782aee3f93b318abcaf77ffc6e043b86a8d
-
Filesize
72KB
MD50dcd5abe50cf2cd1ba15f212897fc5c5
SHA14de7c581909603cd2815799a14415cf34b8cac90
SHA256605a5df82e757dc79b4bdcba0634df1590f89c2c0397b3073b811c6325623fed
SHA5122530a80cf49ebbaa7a8770fd5857260704b414042a60a93c7385e32e83f371bd4b22e9f5ed03867dc3d5af4e2190f782aee3f93b318abcaf77ffc6e043b86a8d
-
Filesize
72KB
MD5b13aab618a5fcacad5c650cf074c39d0
SHA1567927fc8749acfabde8fa91618403a58a536ca8
SHA2568f9bf5c574f46b532a96eb10ca4e9d8d7ada123c6c3d11c3b9a49cfb3ece7fec
SHA512d9ee4637b1a3309262b73bf5017eb7fea53a38fb757721e02747b4a9c62f6d6b0a839b860583c2c74729cec23ee1ba0fecaa43e805dab5e890152f2f411c8bc2
-
Filesize
72KB
MD5b13aab618a5fcacad5c650cf074c39d0
SHA1567927fc8749acfabde8fa91618403a58a536ca8
SHA2568f9bf5c574f46b532a96eb10ca4e9d8d7ada123c6c3d11c3b9a49cfb3ece7fec
SHA512d9ee4637b1a3309262b73bf5017eb7fea53a38fb757721e02747b4a9c62f6d6b0a839b860583c2c74729cec23ee1ba0fecaa43e805dab5e890152f2f411c8bc2
-
Filesize
72KB
MD511d46e1386e8e8a79406d158969e1e75
SHA12c7a4963c5c57e2ed497e79e47516f49b04bdbf4
SHA25665e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209
SHA512a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2
-
Filesize
72KB
MD511d46e1386e8e8a79406d158969e1e75
SHA12c7a4963c5c57e2ed497e79e47516f49b04bdbf4
SHA25665e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209
SHA512a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2
-
Filesize
72KB
MD5f07415d0356ce6a05ec73991919bb427
SHA1686ac8abfa8cc00b25976c1f62527c5259ecc604
SHA25658d9fff2466c8d563f59ff43e62ba5cf621167c8ac3cb2940738997f1ff37989
SHA512271f61d7e8045650feb9ec49f62d34dff74a693c6007a191f648969ae07081775234eb2f8271202bd1cf26beba3ba7b36aa63a598f8dad7331e12b1b467e0974
-
Filesize
72KB
MD5f07415d0356ce6a05ec73991919bb427
SHA1686ac8abfa8cc00b25976c1f62527c5259ecc604
SHA25658d9fff2466c8d563f59ff43e62ba5cf621167c8ac3cb2940738997f1ff37989
SHA512271f61d7e8045650feb9ec49f62d34dff74a693c6007a191f648969ae07081775234eb2f8271202bd1cf26beba3ba7b36aa63a598f8dad7331e12b1b467e0974
-
Filesize
72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
Filesize
72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
Filesize
72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
Filesize
72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
Filesize
72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
Filesize
72KB
MD5516c418a8074d80ff80060dec5d177a8
SHA15b9c7c589220b784d004c443e608403acd14ac73
SHA2567ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40
SHA5128be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387
-
Filesize
72KB
MD5efd61ff0ee43463b867b1b3855e26af1
SHA18bd56501716bbb99f7d11dfc1f50126b8fb5c150
SHA2565623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e
SHA512a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61
-
Filesize
72KB
MD5efd61ff0ee43463b867b1b3855e26af1
SHA18bd56501716bbb99f7d11dfc1f50126b8fb5c150
SHA2565623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e
SHA512a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61
-
Filesize
72KB
MD5414d8ce1afe6582f0087d6e1bc1d2bf7
SHA1d9a251c68a7e0e31a4220e4da919bb5d48e0d51d
SHA25602e5f96ff4caa6218466d2966ab89b34723cba674d8c6e6bea52ba04b23e54a2
SHA51218ca3f6c80dc898447dec848fc2e2f68fd18116986794a3f490c007dc56301c43b66cdba21806676e4e9cd7a79d0bde158ee3610def11b8f277c121167f9c415
-
Filesize
72KB
MD5414d8ce1afe6582f0087d6e1bc1d2bf7
SHA1d9a251c68a7e0e31a4220e4da919bb5d48e0d51d
SHA25602e5f96ff4caa6218466d2966ab89b34723cba674d8c6e6bea52ba04b23e54a2
SHA51218ca3f6c80dc898447dec848fc2e2f68fd18116986794a3f490c007dc56301c43b66cdba21806676e4e9cd7a79d0bde158ee3610def11b8f277c121167f9c415
-
Filesize
72KB
MD511d46e1386e8e8a79406d158969e1e75
SHA12c7a4963c5c57e2ed497e79e47516f49b04bdbf4
SHA25665e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209
SHA512a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2
-
Filesize
72KB
MD511d46e1386e8e8a79406d158969e1e75
SHA12c7a4963c5c57e2ed497e79e47516f49b04bdbf4
SHA25665e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209
SHA512a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2