Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe
Resource
win10v2004-20221111-en
General
-
Target
ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe
-
Size
72KB
-
MD5
095635a8a4d250a425c7d61c38d9c286
-
SHA1
793ecee137fbf8b7a4ce01ce23341800a7aa932d
-
SHA256
ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf
-
SHA512
983b4d9060c7aef35765ad57375b3a72a4e5a16c0a13c1439e779865c3d28cabe309202bbe7999e8dbae026fc9f20030030d71ae7800e766d2937cecca22f80c
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2S:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPG
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2008 backup.exe 1980 backup.exe 1984 backup.exe 1004 backup.exe 924 backup.exe 1404 backup.exe 1644 backup.exe 856 backup.exe 1008 backup.exe 284 backup.exe 1928 backup.exe 516 backup.exe 1784 backup.exe 1236 backup.exe 1072 backup.exe 1696 backup.exe 2036 backup.exe 1652 System Restore.exe 1700 backup.exe 1952 backup.exe 2000 backup.exe 996 backup.exe 1940 System Restore.exe 916 backup.exe 1504 backup.exe 428 backup.exe 1316 backup.exe 1404 backup.exe 1460 System Restore.exe 1660 backup.exe 1308 backup.exe 1812 System Restore.exe 1284 backup.exe 1868 backup.exe 580 backup.exe 1628 backup.exe 1456 backup.exe 1796 backup.exe 832 backup.exe 2024 backup.exe 240 backup.exe 1784 update.exe 1968 backup.exe 1696 backup.exe 760 backup.exe 776 backup.exe 1704 backup.exe 1700 backup.exe 1952 backup.exe 1448 backup.exe 1908 backup.exe 1944 backup.exe 1492 backup.exe 1164 backup.exe 1976 backup.exe 880 backup.exe 428 backup.exe 1404 backup.exe 628 backup.exe 1064 backup.exe 1720 backup.exe 1812 backup.exe 1168 backup.exe 268 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1004 backup.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1004 backup.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1644 backup.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1644 backup.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 1004 backup.exe 1004 backup.exe 1928 backup.exe 1928 backup.exe 516 backup.exe 516 backup.exe 1928 backup.exe 1928 backup.exe 1236 backup.exe 1236 backup.exe 1072 backup.exe 1072 backup.exe 1072 backup.exe 1072 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 2036 backup.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe 1460 System Restore.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe data.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\System Restore.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\Shared\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Services\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 2008 backup.exe 1980 backup.exe 1984 backup.exe 1004 backup.exe 924 backup.exe 1644 backup.exe 1404 backup.exe 856 backup.exe 1008 backup.exe 284 backup.exe 1928 backup.exe 516 backup.exe 1784 backup.exe 1236 backup.exe 1072 backup.exe 1696 backup.exe 2036 backup.exe 1700 backup.exe 1952 backup.exe 2000 backup.exe 996 backup.exe 1940 System Restore.exe 916 backup.exe 1504 backup.exe 428 backup.exe 1316 backup.exe 1404 backup.exe 1460 System Restore.exe 1660 backup.exe 1308 backup.exe 1812 System Restore.exe 1284 backup.exe 1868 backup.exe 580 backup.exe 1628 backup.exe 1456 backup.exe 1796 backup.exe 832 backup.exe 240 backup.exe 2024 backup.exe 1968 backup.exe 760 backup.exe 1696 backup.exe 776 backup.exe 1704 backup.exe 1700 backup.exe 1952 backup.exe 1448 backup.exe 1908 backup.exe 1944 backup.exe 1492 backup.exe 1164 backup.exe 1976 backup.exe 428 backup.exe 880 backup.exe 1404 backup.exe 628 backup.exe 1064 backup.exe 1720 backup.exe 1812 backup.exe 1168 backup.exe 268 backup.exe 432 System Restore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2008 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 27 PID 1360 wrote to memory of 2008 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 27 PID 1360 wrote to memory of 2008 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 27 PID 1360 wrote to memory of 2008 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 27 PID 1360 wrote to memory of 1980 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 28 PID 1360 wrote to memory of 1980 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 28 PID 1360 wrote to memory of 1980 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 28 PID 1360 wrote to memory of 1980 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 28 PID 1360 wrote to memory of 1984 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 29 PID 1360 wrote to memory of 1984 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 29 PID 1360 wrote to memory of 1984 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 29 PID 1360 wrote to memory of 1984 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 29 PID 2008 wrote to memory of 1004 2008 backup.exe 30 PID 2008 wrote to memory of 1004 2008 backup.exe 30 PID 2008 wrote to memory of 1004 2008 backup.exe 30 PID 2008 wrote to memory of 1004 2008 backup.exe 30 PID 1360 wrote to memory of 924 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 31 PID 1360 wrote to memory of 924 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 31 PID 1360 wrote to memory of 924 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 31 PID 1360 wrote to memory of 924 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 31 PID 1004 wrote to memory of 1644 1004 backup.exe 32 PID 1004 wrote to memory of 1644 1004 backup.exe 32 PID 1004 wrote to memory of 1644 1004 backup.exe 32 PID 1004 wrote to memory of 1644 1004 backup.exe 32 PID 1360 wrote to memory of 1404 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 33 PID 1360 wrote to memory of 1404 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 33 PID 1360 wrote to memory of 1404 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 33 PID 1360 wrote to memory of 1404 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 33 PID 1360 wrote to memory of 856 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 34 PID 1360 wrote to memory of 856 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 34 PID 1360 wrote to memory of 856 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 34 PID 1360 wrote to memory of 856 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 34 PID 1644 wrote to memory of 1008 1644 backup.exe 35 PID 1644 wrote to memory of 1008 1644 backup.exe 35 PID 1644 wrote to memory of 1008 1644 backup.exe 35 PID 1644 wrote to memory of 1008 1644 backup.exe 35 PID 1360 wrote to memory of 284 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 36 PID 1360 wrote to memory of 284 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 36 PID 1360 wrote to memory of 284 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 36 PID 1360 wrote to memory of 284 1360 ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe 36 PID 1004 wrote to memory of 1928 1004 backup.exe 37 PID 1004 wrote to memory of 1928 1004 backup.exe 37 PID 1004 wrote to memory of 1928 1004 backup.exe 37 PID 1004 wrote to memory of 1928 1004 backup.exe 37 PID 1928 wrote to memory of 516 1928 backup.exe 38 PID 1928 wrote to memory of 516 1928 backup.exe 38 PID 1928 wrote to memory of 516 1928 backup.exe 38 PID 1928 wrote to memory of 516 1928 backup.exe 38 PID 516 wrote to memory of 1784 516 backup.exe 39 PID 516 wrote to memory of 1784 516 backup.exe 39 PID 516 wrote to memory of 1784 516 backup.exe 39 PID 516 wrote to memory of 1784 516 backup.exe 39 PID 1928 wrote to memory of 1236 1928 backup.exe 40 PID 1928 wrote to memory of 1236 1928 backup.exe 40 PID 1928 wrote to memory of 1236 1928 backup.exe 40 PID 1928 wrote to memory of 1236 1928 backup.exe 40 PID 1236 wrote to memory of 1072 1236 backup.exe 41 PID 1236 wrote to memory of 1072 1236 backup.exe 41 PID 1236 wrote to memory of 1072 1236 backup.exe 41 PID 1236 wrote to memory of 1072 1236 backup.exe 41 PID 1072 wrote to memory of 1696 1072 backup.exe 42 PID 1072 wrote to memory of 1696 1072 backup.exe 42 PID 1072 wrote to memory of 1696 1072 backup.exe 42 PID 1072 wrote to memory of 1696 1072 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe"C:\Users\Admin\AppData\Local\Temp\ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1888776477\backup.exeC:\Users\Admin\AppData\Local\Temp\1888776477\backup.exe C:\Users\Admin\AppData\Local\Temp\1888776477\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1004 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1008
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1236 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:428
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1316
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1460 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1660
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:1784
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:384
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:460
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:828
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1656
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:2096
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:2244
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:2424
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:776 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:660
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- System policy modification
PID:280
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1972 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- System policy modification
PID:996
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:960
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1524 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1448
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:1572
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1548 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1440
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:2116
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:2296
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:2432
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1864
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:564
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1968 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:428 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
C:\Program Files\Common Files\System\ado\en-US\System Restore.exe"C:\Program Files\Common Files\System\ado\en-US\System Restore.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Disables RegEdit via registry modification
PID:1620
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:664
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1516
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1748
-
-
-
C:\Program Files\Common Files\System\de-DE\System Restore.exe"C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:916
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1588
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
PID:1648
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1456
-
-
C:\Program Files\Common Files\System\it-IT\System Restore.exe"C:\Program Files\Common Files\System\it-IT\System Restore.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1516
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:628
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1708 -
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵PID:2044
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵PID:268
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵PID:856
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\data.exe"C:\Program Files\Common Files\System\msadc\fr-FR\data.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵PID:1996
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵PID:944
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵PID:2208
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1284
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:760 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1684
-
-
C:\Program Files\DVD Maker\Shared\data.exe"C:\Program Files\DVD Maker\Shared\data.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1652
-
C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
PID:1692 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1316
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:880
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:432
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1980
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- System policy modification
PID:1472
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:832
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Modifies visibility of file extensions in Explorer
PID:776
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1756
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1456
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:1316
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:616
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:2080
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:2252
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵PID:2408
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:788
-
C:\Program Files\Google\Chrome\data.exe"C:\Program Files\Google\Chrome\data.exe" C:\Program Files\Google\Chrome\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:2012 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Drops file in Program Files directory
PID:920 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
PID:1508 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵PID:2384
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:944
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:532
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1688
-
-
C:\Program Files\Microsoft Games\System Restore.exe"C:\Program Files\Microsoft Games\System Restore.exe" C:\Program Files\Microsoft Games\5⤵PID:1528
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:780
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2216
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2376
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1796 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:832 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:880
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- System policy modification
PID:532
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1528
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
PID:1996 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1448
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- System policy modification
PID:1504
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1668 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1708 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
PID:1772
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1716 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:916
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:580
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
PID:1728 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- System policy modification
PID:1460
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:1684
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1356 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1652
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1948
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1064
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
- System policy modification
PID:284 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
PID:1564 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Disables RegEdit via registry modification
PID:1456
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Disables RegEdit via registry modification
PID:1696
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1932
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵PID:2304
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵PID:2392
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:788
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2020
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:880
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1720 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1132 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
PID:1168
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Disables RegEdit via registry modification
PID:280 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1272 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Modifies visibility of file extensions in Explorer
PID:880 -
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵PID:1284
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- Disables RegEdit via registry modification
PID:1908
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1732
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1700
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1728
-
-
C:\Program Files (x86)\Common Files\Services\data.exe"C:\Program Files (x86)\Common Files\Services\data.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1668
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2132
-
-
C:\Program Files (x86)\Common Files\System\data.exe"C:\Program Files (x86)\Common Files\System\data.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2320
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1076
-
-
C:\Program Files (x86)\Internet Explorer\update.exe"C:\Program Files (x86)\Internet Explorer\update.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:428
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2400
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Disables RegEdit via registry modification
PID:360 -
C:\Users\Admin\data.exeC:\Users\Admin\data.exe C:\Users\Admin\5⤵
- System policy modification
PID:1552 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Disables RegEdit via registry modification
PID:1696
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1428
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1628
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:548
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1448
-
-
C:\Users\Admin\Links\update.exeC:\Users\Admin\Links\update.exe C:\Users\Admin\Links\6⤵PID:1496
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1252
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:1160
-
-
C:\Users\Admin\Saved Games\update.exe"C:\Users\Admin\Saved Games\update.exe" C:\Users\Admin\Saved Games\6⤵PID:2060
-
-
C:\Users\Admin\Searches\data.exeC:\Users\Admin\Searches\data.exe C:\Users\Admin\Searches\6⤵PID:2200
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵PID:2368
-
-
-
C:\Users\Public\System Restore.exe"C:\Users\Public\System Restore.exe" C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
PID:1716 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1616
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1356
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:2108
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:2288
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵PID:2416
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:1712 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1868
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1680
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:2184
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2360
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:284
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5308967c4254e4338a3ef9148f18baa0e
SHA19430a0b0aedd0f09650a88313bd1a6158fc068ba
SHA25630880e0d8b78f827d3a4535f7f683eb9a496e4b5ea02f4ef6e1abd2450a06ff4
SHA512957e079a1e04e651e9b77ebbdc66f2989d21b156b1a6004e59fd750853bd45387409e38ddb602328d64bbc40d3d2a9b91c9ed084ed9fe7eaf93a9a21d29da0ac
-
Filesize
72KB
MD57be4f2977449d2d4bc408aa59a393141
SHA13b6916ef451190893c8c6672392b3df5a347c2e5
SHA25604244912051c5866dec70d88320bc9ccd30e5e9f10e930488f99d7acc1f6d630
SHA5126c435b9ed7c606a1937b4f2520367b44822d634c1285a230896fd2117092a5b6ecb48ff5f259268b6f16319ba39442cad2f78577d16e0ad3cb6c1f11ff8382b0
-
Filesize
72KB
MD57be4f2977449d2d4bc408aa59a393141
SHA13b6916ef451190893c8c6672392b3df5a347c2e5
SHA25604244912051c5866dec70d88320bc9ccd30e5e9f10e930488f99d7acc1f6d630
SHA5126c435b9ed7c606a1937b4f2520367b44822d634c1285a230896fd2117092a5b6ecb48ff5f259268b6f16319ba39442cad2f78577d16e0ad3cb6c1f11ff8382b0
-
Filesize
72KB
MD50c05212034bd6831fd19be79df45ade9
SHA1a393f941ff055b9157667d03d1951f1fdbaa3d24
SHA2563057b93571d6652e9529fe962bbc150bef6dcbf0b873cdde5f22b0e44b2bf4dc
SHA512b3f44920bb9536caabec922d8dca96ec6cc376c97c076793656a8503ff4b9937cc303dc44bd39a2195b7abfd8dd1391a4d881c5f312dc3d5b90b1e13195e5a01
-
Filesize
72KB
MD56b84b764b39a63ead2d9bcba66d1fdf3
SHA18b8c957cc2670448fa75ad95054ee5d8917d03cf
SHA2565fff6d0fd9811f80410ec65c496c6b30a0f2282dad6eec3534934f226eb06ecd
SHA512566c1996d37c8115b7bc7c42cb4b2ba6028cfcf2a23acf32f7be201085322af31c21fed6d8a80d0efcc88845dba27d498c970ae369ad05c47823ad9f1f37b2cb
-
Filesize
72KB
MD56b84b764b39a63ead2d9bcba66d1fdf3
SHA18b8c957cc2670448fa75ad95054ee5d8917d03cf
SHA2565fff6d0fd9811f80410ec65c496c6b30a0f2282dad6eec3534934f226eb06ecd
SHA512566c1996d37c8115b7bc7c42cb4b2ba6028cfcf2a23acf32f7be201085322af31c21fed6d8a80d0efcc88845dba27d498c970ae369ad05c47823ad9f1f37b2cb
-
Filesize
72KB
MD5db667c5d43eb0eb7058bbad89c1ab448
SHA1f1c15e606631b2a78cb9dd49428cfae976ab2bf1
SHA256dcdd3f42dc6606995a8f27736c57313a5b321a20f7898723f5f998482a833d54
SHA512ddd39ecb6abe167f913d03005e8e565c14f7f2207cec910f8ed5a5534e2fab296b084b8ed40e06eeda3ca484dfeec070647259e10732ba90f5f01bf591ae6df1
-
Filesize
72KB
MD5caaa0fae91d9953519056e8d7d2487be
SHA17359c748f20084c2a5c791e652e56fc570a6430f
SHA2560911ae1fd3992fc99f79228b1f6f7233eb9b9afbaf694d1f58103004688caf69
SHA5123f406ff09540e099241a66662bd87fb3d1df7284e9d0184df56e345542f857aa7100fb16f2d8bb69af445550830e01a6b95d633ff9162f2f6beec2d99ec348a8
-
Filesize
72KB
MD5caaa0fae91d9953519056e8d7d2487be
SHA17359c748f20084c2a5c791e652e56fc570a6430f
SHA2560911ae1fd3992fc99f79228b1f6f7233eb9b9afbaf694d1f58103004688caf69
SHA5123f406ff09540e099241a66662bd87fb3d1df7284e9d0184df56e345542f857aa7100fb16f2d8bb69af445550830e01a6b95d633ff9162f2f6beec2d99ec348a8
-
Filesize
72KB
MD50bfda2b8f11616ee99d171b6a970bdcf
SHA10d93c7656a801c5d5e954d3b290d8b779d1fda2d
SHA25617456364272e236e73cd6b7783709953b7abdeb2720de914d4ebc35dcb885f9d
SHA512f83679a3b8053b3bb7d9f1fff05f52c6006f43fb2916da34167f1d82d830741f2f72cfe47d230d01c06ea1018e366f1c0762db07eacecd33550fcac1b0ad2a7f
-
Filesize
72KB
MD53b0a64b60a0f0aebabae88b1a97749cf
SHA1b54535a7b2f66a8e5953aab390b357a1400ffd4e
SHA256303c6ec0993e9c98e60ab84034f97115e99387f769a9518acacaf16a5ee0b037
SHA51234140950d78076cf3d8bc5213c55cef5f57f0760d631ff4fdec9e2ada354a0c92fb6df0da4741a4e0be46f0cb4ca2f1f21942c419779b4ffd94b11789426511c
-
Filesize
72KB
MD53b0a64b60a0f0aebabae88b1a97749cf
SHA1b54535a7b2f66a8e5953aab390b357a1400ffd4e
SHA256303c6ec0993e9c98e60ab84034f97115e99387f769a9518acacaf16a5ee0b037
SHA51234140950d78076cf3d8bc5213c55cef5f57f0760d631ff4fdec9e2ada354a0c92fb6df0da4741a4e0be46f0cb4ca2f1f21942c419779b4ffd94b11789426511c
-
Filesize
72KB
MD50bfda2b8f11616ee99d171b6a970bdcf
SHA10d93c7656a801c5d5e954d3b290d8b779d1fda2d
SHA25617456364272e236e73cd6b7783709953b7abdeb2720de914d4ebc35dcb885f9d
SHA512f83679a3b8053b3bb7d9f1fff05f52c6006f43fb2916da34167f1d82d830741f2f72cfe47d230d01c06ea1018e366f1c0762db07eacecd33550fcac1b0ad2a7f
-
Filesize
72KB
MD5eb007b9bda9c58fa5aca5750e62cd8ec
SHA195ac97c06e60e14899a40ec8a6ce9e62d372dc77
SHA2560341c75f67e382bb7da134c2496672ad18ad292cae49ad846af961cae59f0d46
SHA5121f033427e3b5a42ea397d0480797ddaa5ed027cdb9f5bac0fc8988f6d3c81d86f5108a0013486c1cee441e498a587a5002acbf65050e3dcb9be58c81d25de0cb
-
Filesize
72KB
MD5eb007b9bda9c58fa5aca5750e62cd8ec
SHA195ac97c06e60e14899a40ec8a6ce9e62d372dc77
SHA2560341c75f67e382bb7da134c2496672ad18ad292cae49ad846af961cae59f0d46
SHA5121f033427e3b5a42ea397d0480797ddaa5ed027cdb9f5bac0fc8988f6d3c81d86f5108a0013486c1cee441e498a587a5002acbf65050e3dcb9be58c81d25de0cb
-
Filesize
72KB
MD5100d5ac2b978f8ba155ae7909babc231
SHA19b0b3dc5876e8c01f7a668b9c8957912a68147bf
SHA256714d4a611832b76c72d906a942538fa748cf65172176afecb26714f05908e0a7
SHA512cfd0e1c8289dbcbebb93b1ac99f2c898ebbcb2fdb2e340089c25ade3681b450454b446b0423db4434cc84865841af31f35020c2bbcfb691bd079174d8f843e91
-
Filesize
72KB
MD5100d5ac2b978f8ba155ae7909babc231
SHA19b0b3dc5876e8c01f7a668b9c8957912a68147bf
SHA256714d4a611832b76c72d906a942538fa748cf65172176afecb26714f05908e0a7
SHA512cfd0e1c8289dbcbebb93b1ac99f2c898ebbcb2fdb2e340089c25ade3681b450454b446b0423db4434cc84865841af31f35020c2bbcfb691bd079174d8f843e91
-
Filesize
72KB
MD5c64d6efbe9f438347ec98c0946ea6a55
SHA11154ce52b2627d61b67dd1a9919e2f8c2d534232
SHA256e0b1bfb763811e5ac4e25ec373018fe5b716d07ea7c79848589bbdaa605fac25
SHA512fbbc027636c4196615aa87cb6ee08046edc8e6680cf3bdb22e4c8c854d048e352e120273b550efb479012b3d6ea25f4ca56a3f72d1d9211a5251e13bf2e60a1d
-
Filesize
72KB
MD5c64d6efbe9f438347ec98c0946ea6a55
SHA11154ce52b2627d61b67dd1a9919e2f8c2d534232
SHA256e0b1bfb763811e5ac4e25ec373018fe5b716d07ea7c79848589bbdaa605fac25
SHA512fbbc027636c4196615aa87cb6ee08046edc8e6680cf3bdb22e4c8c854d048e352e120273b550efb479012b3d6ea25f4ca56a3f72d1d9211a5251e13bf2e60a1d
-
Filesize
72KB
MD59f5c767c7f6c03fd70e7c48e4807551d
SHA19800df6dc99439f280c7280939dc7f0a734723ed
SHA256e55bb4125fc0e2d8ab05b9f82c35543d90c6f5cf311c9d9af600eb054a6f2f1b
SHA51248b2c7abd2dd2a9bea424ac2bd9d79f277baa6b2b2b80ad8a7ae2d513b2167a6d6402a43901bc154054773fe4914e5e4e5ff5f6d2682bcf4e32c329f1087bde9
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56a9baa55ed5b293ab037092f13e147b6
SHA161350bd03a24a098da2b16e143d5fb68aed5657c
SHA2564120946a0b008e4cdf4f7d25379cbfa21fc2ac82bbe6adc6fa78b2ad6446cd0a
SHA512808cc512da271f821581e6753a504b30316015c5c9c4767f98564dc92c343660d4d10d3d1a65284791ba39da9e209b4b15e0b1a43efe475485ba0bea41d0198d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5194d024b1852851a7c16ee3de5174cd0
SHA182aa2aa89977641c1f06224782aa08efe79aa80c
SHA256e63a25ddcafebdfe6927d98e98fce57dc624d4f9c2aac4b1a7077811b5510dd7
SHA51233ba0b6139de933ebe5e6af743460dc4f5c72f724932f94a74cf480517e2719ba3610a5c873833eb7d95f70491416d88b47eff956ccfd6dbeec46419f916ccc4
-
Filesize
72KB
MD5b1da17f22642ea30b00f255379ab7109
SHA16150fbba39808673bae5e68a34db81de9c9b1b5a
SHA2562dd4e668c50fe208183eda6e1deda79531141e4bd1cad6856850e5fc0798140a
SHA5123974ac05dfc0e6b30d33bfcac1c7db692c8e792374a6541f252871b3389a0081e7eecac169514843911e8c2044c014b1ce4e9811b7b500097ad2b6f7478024a9
-
Filesize
72KB
MD59f5c767c7f6c03fd70e7c48e4807551d
SHA19800df6dc99439f280c7280939dc7f0a734723ed
SHA256e55bb4125fc0e2d8ab05b9f82c35543d90c6f5cf311c9d9af600eb054a6f2f1b
SHA51248b2c7abd2dd2a9bea424ac2bd9d79f277baa6b2b2b80ad8a7ae2d513b2167a6d6402a43901bc154054773fe4914e5e4e5ff5f6d2682bcf4e32c329f1087bde9
-
Filesize
72KB
MD5da62de93fbbfe7a94bb0ba6572ee5887
SHA1622415bf5b51c7602f1b4dc29c9650eb030a4c91
SHA2569a81fa5ff1f20f0e5c01f492db9a8e8740beb7ad74582b5b1ebcc38e3801c543
SHA512c649d68e08e9604d20a21d7f7eedd09fecdb1c4f585bf796f48c6b00e83820c37b73f5d66326219ac88e44e1d1da520fa55bddb2d4de6e6267ae3b3347baf6c5
-
Filesize
72KB
MD5c5d986f632a36112e4e90c42cc391d98
SHA173db49a5d4b37dd004b2798fa8bdae9a893e702e
SHA256838baddfdb23c8cf457d999c3338b0441cee9b0f0f30865b2d5165d492832527
SHA5124629a980e019b0a492dc3ccdaa9501a5fb02066408e1988747ad31f13b5f7fd7c62f8820d4021bda45ac4597589b2799c677f7ca271d8418b4c508b6d492fc06
-
Filesize
72KB
MD5c5d986f632a36112e4e90c42cc391d98
SHA173db49a5d4b37dd004b2798fa8bdae9a893e702e
SHA256838baddfdb23c8cf457d999c3338b0441cee9b0f0f30865b2d5165d492832527
SHA5124629a980e019b0a492dc3ccdaa9501a5fb02066408e1988747ad31f13b5f7fd7c62f8820d4021bda45ac4597589b2799c677f7ca271d8418b4c508b6d492fc06
-
Filesize
72KB
MD5308967c4254e4338a3ef9148f18baa0e
SHA19430a0b0aedd0f09650a88313bd1a6158fc068ba
SHA25630880e0d8b78f827d3a4535f7f683eb9a496e4b5ea02f4ef6e1abd2450a06ff4
SHA512957e079a1e04e651e9b77ebbdc66f2989d21b156b1a6004e59fd750853bd45387409e38ddb602328d64bbc40d3d2a9b91c9ed084ed9fe7eaf93a9a21d29da0ac
-
Filesize
72KB
MD5308967c4254e4338a3ef9148f18baa0e
SHA19430a0b0aedd0f09650a88313bd1a6158fc068ba
SHA25630880e0d8b78f827d3a4535f7f683eb9a496e4b5ea02f4ef6e1abd2450a06ff4
SHA512957e079a1e04e651e9b77ebbdc66f2989d21b156b1a6004e59fd750853bd45387409e38ddb602328d64bbc40d3d2a9b91c9ed084ed9fe7eaf93a9a21d29da0ac
-
Filesize
72KB
MD57be4f2977449d2d4bc408aa59a393141
SHA13b6916ef451190893c8c6672392b3df5a347c2e5
SHA25604244912051c5866dec70d88320bc9ccd30e5e9f10e930488f99d7acc1f6d630
SHA5126c435b9ed7c606a1937b4f2520367b44822d634c1285a230896fd2117092a5b6ecb48ff5f259268b6f16319ba39442cad2f78577d16e0ad3cb6c1f11ff8382b0
-
Filesize
72KB
MD57be4f2977449d2d4bc408aa59a393141
SHA13b6916ef451190893c8c6672392b3df5a347c2e5
SHA25604244912051c5866dec70d88320bc9ccd30e5e9f10e930488f99d7acc1f6d630
SHA5126c435b9ed7c606a1937b4f2520367b44822d634c1285a230896fd2117092a5b6ecb48ff5f259268b6f16319ba39442cad2f78577d16e0ad3cb6c1f11ff8382b0
-
Filesize
72KB
MD50c05212034bd6831fd19be79df45ade9
SHA1a393f941ff055b9157667d03d1951f1fdbaa3d24
SHA2563057b93571d6652e9529fe962bbc150bef6dcbf0b873cdde5f22b0e44b2bf4dc
SHA512b3f44920bb9536caabec922d8dca96ec6cc376c97c076793656a8503ff4b9937cc303dc44bd39a2195b7abfd8dd1391a4d881c5f312dc3d5b90b1e13195e5a01
-
Filesize
72KB
MD50c05212034bd6831fd19be79df45ade9
SHA1a393f941ff055b9157667d03d1951f1fdbaa3d24
SHA2563057b93571d6652e9529fe962bbc150bef6dcbf0b873cdde5f22b0e44b2bf4dc
SHA512b3f44920bb9536caabec922d8dca96ec6cc376c97c076793656a8503ff4b9937cc303dc44bd39a2195b7abfd8dd1391a4d881c5f312dc3d5b90b1e13195e5a01
-
Filesize
72KB
MD56b84b764b39a63ead2d9bcba66d1fdf3
SHA18b8c957cc2670448fa75ad95054ee5d8917d03cf
SHA2565fff6d0fd9811f80410ec65c496c6b30a0f2282dad6eec3534934f226eb06ecd
SHA512566c1996d37c8115b7bc7c42cb4b2ba6028cfcf2a23acf32f7be201085322af31c21fed6d8a80d0efcc88845dba27d498c970ae369ad05c47823ad9f1f37b2cb
-
Filesize
72KB
MD56b84b764b39a63ead2d9bcba66d1fdf3
SHA18b8c957cc2670448fa75ad95054ee5d8917d03cf
SHA2565fff6d0fd9811f80410ec65c496c6b30a0f2282dad6eec3534934f226eb06ecd
SHA512566c1996d37c8115b7bc7c42cb4b2ba6028cfcf2a23acf32f7be201085322af31c21fed6d8a80d0efcc88845dba27d498c970ae369ad05c47823ad9f1f37b2cb
-
Filesize
72KB
MD5db667c5d43eb0eb7058bbad89c1ab448
SHA1f1c15e606631b2a78cb9dd49428cfae976ab2bf1
SHA256dcdd3f42dc6606995a8f27736c57313a5b321a20f7898723f5f998482a833d54
SHA512ddd39ecb6abe167f913d03005e8e565c14f7f2207cec910f8ed5a5534e2fab296b084b8ed40e06eeda3ca484dfeec070647259e10732ba90f5f01bf591ae6df1
-
Filesize
72KB
MD5db667c5d43eb0eb7058bbad89c1ab448
SHA1f1c15e606631b2a78cb9dd49428cfae976ab2bf1
SHA256dcdd3f42dc6606995a8f27736c57313a5b321a20f7898723f5f998482a833d54
SHA512ddd39ecb6abe167f913d03005e8e565c14f7f2207cec910f8ed5a5534e2fab296b084b8ed40e06eeda3ca484dfeec070647259e10732ba90f5f01bf591ae6df1
-
Filesize
72KB
MD5caaa0fae91d9953519056e8d7d2487be
SHA17359c748f20084c2a5c791e652e56fc570a6430f
SHA2560911ae1fd3992fc99f79228b1f6f7233eb9b9afbaf694d1f58103004688caf69
SHA5123f406ff09540e099241a66662bd87fb3d1df7284e9d0184df56e345542f857aa7100fb16f2d8bb69af445550830e01a6b95d633ff9162f2f6beec2d99ec348a8
-
Filesize
72KB
MD5caaa0fae91d9953519056e8d7d2487be
SHA17359c748f20084c2a5c791e652e56fc570a6430f
SHA2560911ae1fd3992fc99f79228b1f6f7233eb9b9afbaf694d1f58103004688caf69
SHA5123f406ff09540e099241a66662bd87fb3d1df7284e9d0184df56e345542f857aa7100fb16f2d8bb69af445550830e01a6b95d633ff9162f2f6beec2d99ec348a8
-
Filesize
72KB
MD50bfda2b8f11616ee99d171b6a970bdcf
SHA10d93c7656a801c5d5e954d3b290d8b779d1fda2d
SHA25617456364272e236e73cd6b7783709953b7abdeb2720de914d4ebc35dcb885f9d
SHA512f83679a3b8053b3bb7d9f1fff05f52c6006f43fb2916da34167f1d82d830741f2f72cfe47d230d01c06ea1018e366f1c0762db07eacecd33550fcac1b0ad2a7f
-
Filesize
72KB
MD50bfda2b8f11616ee99d171b6a970bdcf
SHA10d93c7656a801c5d5e954d3b290d8b779d1fda2d
SHA25617456364272e236e73cd6b7783709953b7abdeb2720de914d4ebc35dcb885f9d
SHA512f83679a3b8053b3bb7d9f1fff05f52c6006f43fb2916da34167f1d82d830741f2f72cfe47d230d01c06ea1018e366f1c0762db07eacecd33550fcac1b0ad2a7f
-
Filesize
72KB
MD53b0a64b60a0f0aebabae88b1a97749cf
SHA1b54535a7b2f66a8e5953aab390b357a1400ffd4e
SHA256303c6ec0993e9c98e60ab84034f97115e99387f769a9518acacaf16a5ee0b037
SHA51234140950d78076cf3d8bc5213c55cef5f57f0760d631ff4fdec9e2ada354a0c92fb6df0da4741a4e0be46f0cb4ca2f1f21942c419779b4ffd94b11789426511c
-
Filesize
72KB
MD53b0a64b60a0f0aebabae88b1a97749cf
SHA1b54535a7b2f66a8e5953aab390b357a1400ffd4e
SHA256303c6ec0993e9c98e60ab84034f97115e99387f769a9518acacaf16a5ee0b037
SHA51234140950d78076cf3d8bc5213c55cef5f57f0760d631ff4fdec9e2ada354a0c92fb6df0da4741a4e0be46f0cb4ca2f1f21942c419779b4ffd94b11789426511c
-
Filesize
72KB
MD50bfda2b8f11616ee99d171b6a970bdcf
SHA10d93c7656a801c5d5e954d3b290d8b779d1fda2d
SHA25617456364272e236e73cd6b7783709953b7abdeb2720de914d4ebc35dcb885f9d
SHA512f83679a3b8053b3bb7d9f1fff05f52c6006f43fb2916da34167f1d82d830741f2f72cfe47d230d01c06ea1018e366f1c0762db07eacecd33550fcac1b0ad2a7f
-
Filesize
72KB
MD50bfda2b8f11616ee99d171b6a970bdcf
SHA10d93c7656a801c5d5e954d3b290d8b779d1fda2d
SHA25617456364272e236e73cd6b7783709953b7abdeb2720de914d4ebc35dcb885f9d
SHA512f83679a3b8053b3bb7d9f1fff05f52c6006f43fb2916da34167f1d82d830741f2f72cfe47d230d01c06ea1018e366f1c0762db07eacecd33550fcac1b0ad2a7f
-
Filesize
72KB
MD548d1c8fff051ce7a0c8dc64051a1e02e
SHA1a42387cdb1e76b0286be60facbf4caa1905e984e
SHA256cbd6d1613745be5b995180292882c6d0c3a71da5243944fe487a019fa42c07e5
SHA5122a8d1713c3d4a80b35a7fe23d6f759d838265024b965a7a012529318f67be6858ed665780afe3fbb00c15ba6f3a550c0e0da967d974354ae6ddcceaff49c0864
-
Filesize
72KB
MD5eb007b9bda9c58fa5aca5750e62cd8ec
SHA195ac97c06e60e14899a40ec8a6ce9e62d372dc77
SHA2560341c75f67e382bb7da134c2496672ad18ad292cae49ad846af961cae59f0d46
SHA5121f033427e3b5a42ea397d0480797ddaa5ed027cdb9f5bac0fc8988f6d3c81d86f5108a0013486c1cee441e498a587a5002acbf65050e3dcb9be58c81d25de0cb
-
Filesize
72KB
MD5eb007b9bda9c58fa5aca5750e62cd8ec
SHA195ac97c06e60e14899a40ec8a6ce9e62d372dc77
SHA2560341c75f67e382bb7da134c2496672ad18ad292cae49ad846af961cae59f0d46
SHA5121f033427e3b5a42ea397d0480797ddaa5ed027cdb9f5bac0fc8988f6d3c81d86f5108a0013486c1cee441e498a587a5002acbf65050e3dcb9be58c81d25de0cb
-
Filesize
72KB
MD5100d5ac2b978f8ba155ae7909babc231
SHA19b0b3dc5876e8c01f7a668b9c8957912a68147bf
SHA256714d4a611832b76c72d906a942538fa748cf65172176afecb26714f05908e0a7
SHA512cfd0e1c8289dbcbebb93b1ac99f2c898ebbcb2fdb2e340089c25ade3681b450454b446b0423db4434cc84865841af31f35020c2bbcfb691bd079174d8f843e91
-
Filesize
72KB
MD5100d5ac2b978f8ba155ae7909babc231
SHA19b0b3dc5876e8c01f7a668b9c8957912a68147bf
SHA256714d4a611832b76c72d906a942538fa748cf65172176afecb26714f05908e0a7
SHA512cfd0e1c8289dbcbebb93b1ac99f2c898ebbcb2fdb2e340089c25ade3681b450454b446b0423db4434cc84865841af31f35020c2bbcfb691bd079174d8f843e91
-
Filesize
72KB
MD5c64d6efbe9f438347ec98c0946ea6a55
SHA11154ce52b2627d61b67dd1a9919e2f8c2d534232
SHA256e0b1bfb763811e5ac4e25ec373018fe5b716d07ea7c79848589bbdaa605fac25
SHA512fbbc027636c4196615aa87cb6ee08046edc8e6680cf3bdb22e4c8c854d048e352e120273b550efb479012b3d6ea25f4ca56a3f72d1d9211a5251e13bf2e60a1d
-
Filesize
72KB
MD5c64d6efbe9f438347ec98c0946ea6a55
SHA11154ce52b2627d61b67dd1a9919e2f8c2d534232
SHA256e0b1bfb763811e5ac4e25ec373018fe5b716d07ea7c79848589bbdaa605fac25
SHA512fbbc027636c4196615aa87cb6ee08046edc8e6680cf3bdb22e4c8c854d048e352e120273b550efb479012b3d6ea25f4ca56a3f72d1d9211a5251e13bf2e60a1d
-
Filesize
72KB
MD59f5c767c7f6c03fd70e7c48e4807551d
SHA19800df6dc99439f280c7280939dc7f0a734723ed
SHA256e55bb4125fc0e2d8ab05b9f82c35543d90c6f5cf311c9d9af600eb054a6f2f1b
SHA51248b2c7abd2dd2a9bea424ac2bd9d79f277baa6b2b2b80ad8a7ae2d513b2167a6d6402a43901bc154054773fe4914e5e4e5ff5f6d2682bcf4e32c329f1087bde9
-
Filesize
72KB
MD59f5c767c7f6c03fd70e7c48e4807551d
SHA19800df6dc99439f280c7280939dc7f0a734723ed
SHA256e55bb4125fc0e2d8ab05b9f82c35543d90c6f5cf311c9d9af600eb054a6f2f1b
SHA51248b2c7abd2dd2a9bea424ac2bd9d79f277baa6b2b2b80ad8a7ae2d513b2167a6d6402a43901bc154054773fe4914e5e4e5ff5f6d2682bcf4e32c329f1087bde9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56a9baa55ed5b293ab037092f13e147b6
SHA161350bd03a24a098da2b16e143d5fb68aed5657c
SHA2564120946a0b008e4cdf4f7d25379cbfa21fc2ac82bbe6adc6fa78b2ad6446cd0a
SHA512808cc512da271f821581e6753a504b30316015c5c9c4767f98564dc92c343660d4d10d3d1a65284791ba39da9e209b4b15e0b1a43efe475485ba0bea41d0198d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56a9baa55ed5b293ab037092f13e147b6
SHA161350bd03a24a098da2b16e143d5fb68aed5657c
SHA2564120946a0b008e4cdf4f7d25379cbfa21fc2ac82bbe6adc6fa78b2ad6446cd0a
SHA512808cc512da271f821581e6753a504b30316015c5c9c4767f98564dc92c343660d4d10d3d1a65284791ba39da9e209b4b15e0b1a43efe475485ba0bea41d0198d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5194d024b1852851a7c16ee3de5174cd0
SHA182aa2aa89977641c1f06224782aa08efe79aa80c
SHA256e63a25ddcafebdfe6927d98e98fce57dc624d4f9c2aac4b1a7077811b5510dd7
SHA51233ba0b6139de933ebe5e6af743460dc4f5c72f724932f94a74cf480517e2719ba3610a5c873833eb7d95f70491416d88b47eff956ccfd6dbeec46419f916ccc4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5194d024b1852851a7c16ee3de5174cd0
SHA182aa2aa89977641c1f06224782aa08efe79aa80c
SHA256e63a25ddcafebdfe6927d98e98fce57dc624d4f9c2aac4b1a7077811b5510dd7
SHA51233ba0b6139de933ebe5e6af743460dc4f5c72f724932f94a74cf480517e2719ba3610a5c873833eb7d95f70491416d88b47eff956ccfd6dbeec46419f916ccc4
-
Filesize
72KB
MD5b1da17f22642ea30b00f255379ab7109
SHA16150fbba39808673bae5e68a34db81de9c9b1b5a
SHA2562dd4e668c50fe208183eda6e1deda79531141e4bd1cad6856850e5fc0798140a
SHA5123974ac05dfc0e6b30d33bfcac1c7db692c8e792374a6541f252871b3389a0081e7eecac169514843911e8c2044c014b1ce4e9811b7b500097ad2b6f7478024a9
-
Filesize
72KB
MD5b1da17f22642ea30b00f255379ab7109
SHA16150fbba39808673bae5e68a34db81de9c9b1b5a
SHA2562dd4e668c50fe208183eda6e1deda79531141e4bd1cad6856850e5fc0798140a
SHA5123974ac05dfc0e6b30d33bfcac1c7db692c8e792374a6541f252871b3389a0081e7eecac169514843911e8c2044c014b1ce4e9811b7b500097ad2b6f7478024a9
-
Filesize
72KB
MD59f5c767c7f6c03fd70e7c48e4807551d
SHA19800df6dc99439f280c7280939dc7f0a734723ed
SHA256e55bb4125fc0e2d8ab05b9f82c35543d90c6f5cf311c9d9af600eb054a6f2f1b
SHA51248b2c7abd2dd2a9bea424ac2bd9d79f277baa6b2b2b80ad8a7ae2d513b2167a6d6402a43901bc154054773fe4914e5e4e5ff5f6d2682bcf4e32c329f1087bde9
-
Filesize
72KB
MD59f5c767c7f6c03fd70e7c48e4807551d
SHA19800df6dc99439f280c7280939dc7f0a734723ed
SHA256e55bb4125fc0e2d8ab05b9f82c35543d90c6f5cf311c9d9af600eb054a6f2f1b
SHA51248b2c7abd2dd2a9bea424ac2bd9d79f277baa6b2b2b80ad8a7ae2d513b2167a6d6402a43901bc154054773fe4914e5e4e5ff5f6d2682bcf4e32c329f1087bde9
-
Filesize
72KB
MD5da62de93fbbfe7a94bb0ba6572ee5887
SHA1622415bf5b51c7602f1b4dc29c9650eb030a4c91
SHA2569a81fa5ff1f20f0e5c01f492db9a8e8740beb7ad74582b5b1ebcc38e3801c543
SHA512c649d68e08e9604d20a21d7f7eedd09fecdb1c4f585bf796f48c6b00e83820c37b73f5d66326219ac88e44e1d1da520fa55bddb2d4de6e6267ae3b3347baf6c5
-
Filesize
72KB
MD5da62de93fbbfe7a94bb0ba6572ee5887
SHA1622415bf5b51c7602f1b4dc29c9650eb030a4c91
SHA2569a81fa5ff1f20f0e5c01f492db9a8e8740beb7ad74582b5b1ebcc38e3801c543
SHA512c649d68e08e9604d20a21d7f7eedd09fecdb1c4f585bf796f48c6b00e83820c37b73f5d66326219ac88e44e1d1da520fa55bddb2d4de6e6267ae3b3347baf6c5