Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe
Resource
win10v2004-20220812-en
General
-
Target
6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe
-
Size
72KB
-
MD5
0c1a0ca5697acb1ba2ac3f0ccd2754f7
-
SHA1
d9ebd4e6f1ff0f9d7a2ca8ee7b6b6d14276c388f
-
SHA256
6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d
-
SHA512
bae78f8d07a0b589cf61540746b7ecefb1dc00dbba8ea7b1fac22d3ef51cca0a464142f79fa47514060f266591b13788df91319938fd064b5751dd49f601326b
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf20:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 888 backup.exe 1292 backup.exe 1472 backup.exe 268 backup.exe 516 backup.exe 1820 backup.exe 1428 backup.exe 1676 backup.exe 1064 backup.exe 1944 backup.exe 2016 backup.exe 832 backup.exe 1760 backup.exe 1920 backup.exe 840 backup.exe 1264 backup.exe 1160 backup.exe 912 backup.exe 836 backup.exe 856 data.exe 1616 backup.exe 524 update.exe 1412 data.exe 1556 System Restore.exe 1480 backup.exe 1464 data.exe 1068 backup.exe 1800 backup.exe 240 backup.exe 1748 backup.exe 308 backup.exe 1904 backup.exe 1960 data.exe 772 backup.exe 1612 backup.exe 1924 backup.exe 1188 backup.exe 1956 backup.exe 1652 backup.exe 1648 backup.exe 748 System Restore.exe 980 backup.exe 1736 update.exe 1576 backup.exe 944 backup.exe 1596 backup.exe 1900 backup.exe 112 backup.exe 1408 backup.exe 1520 backup.exe 1000 backup.exe 1764 backup.exe 584 backup.exe 1344 backup.exe 516 backup.exe 1684 backup.exe 1868 backup.exe 556 backup.exe 1748 backup.exe 1984 backup.exe 1904 backup.exe 672 backup.exe 1608 backup.exe 1132 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 1676 backup.exe 1676 backup.exe 1064 backup.exe 1064 backup.exe 1676 backup.exe 1676 backup.exe 2016 backup.exe 2016 backup.exe 832 backup.exe 832 backup.exe 2016 backup.exe 2016 backup.exe 1920 backup.exe 1920 backup.exe 840 backup.exe 840 backup.exe 840 backup.exe 840 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 524 update.exe 524 update.exe 524 update.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 1160 backup.exe 240 backup.exe 240 backup.exe 240 backup.exe 240 backup.exe 240 backup.exe 240 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe update.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Update\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 888 backup.exe 1292 backup.exe 1472 backup.exe 268 backup.exe 516 backup.exe 1820 backup.exe 1428 backup.exe 1676 backup.exe 1064 backup.exe 1944 backup.exe 2016 backup.exe 832 backup.exe 1760 backup.exe 1920 backup.exe 840 backup.exe 1264 backup.exe 1160 backup.exe 912 backup.exe 836 backup.exe 856 data.exe 1616 backup.exe 524 update.exe 1412 data.exe 1556 System Restore.exe 1480 backup.exe 1464 data.exe 1068 backup.exe 1800 backup.exe 240 backup.exe 1748 backup.exe 308 backup.exe 1904 backup.exe 1960 data.exe 772 backup.exe 1612 backup.exe 1924 backup.exe 1188 backup.exe 1956 backup.exe 1652 backup.exe 1648 backup.exe 748 System Restore.exe 980 backup.exe 1736 update.exe 1576 backup.exe 944 backup.exe 1596 backup.exe 1900 backup.exe 112 backup.exe 1408 backup.exe 1520 backup.exe 1000 backup.exe 1764 backup.exe 584 backup.exe 1344 backup.exe 516 backup.exe 1684 backup.exe 1868 backup.exe 556 backup.exe 1748 backup.exe 1984 backup.exe 1904 backup.exe 672 backup.exe 1608 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1112 wrote to memory of 888 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 27 PID 1112 wrote to memory of 888 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 27 PID 1112 wrote to memory of 888 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 27 PID 1112 wrote to memory of 888 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 27 PID 1112 wrote to memory of 1292 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 28 PID 1112 wrote to memory of 1292 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 28 PID 1112 wrote to memory of 1292 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 28 PID 1112 wrote to memory of 1292 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 28 PID 1112 wrote to memory of 1472 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 29 PID 1112 wrote to memory of 1472 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 29 PID 1112 wrote to memory of 1472 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 29 PID 1112 wrote to memory of 1472 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 29 PID 1112 wrote to memory of 268 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 30 PID 1112 wrote to memory of 268 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 30 PID 1112 wrote to memory of 268 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 30 PID 1112 wrote to memory of 268 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 30 PID 1112 wrote to memory of 516 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 31 PID 1112 wrote to memory of 516 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 31 PID 1112 wrote to memory of 516 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 31 PID 1112 wrote to memory of 516 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 31 PID 1112 wrote to memory of 1820 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 32 PID 1112 wrote to memory of 1820 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 32 PID 1112 wrote to memory of 1820 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 32 PID 1112 wrote to memory of 1820 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 32 PID 1112 wrote to memory of 1428 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 33 PID 1112 wrote to memory of 1428 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 33 PID 1112 wrote to memory of 1428 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 33 PID 1112 wrote to memory of 1428 1112 6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe 33 PID 888 wrote to memory of 1676 888 backup.exe 34 PID 888 wrote to memory of 1676 888 backup.exe 34 PID 888 wrote to memory of 1676 888 backup.exe 34 PID 888 wrote to memory of 1676 888 backup.exe 34 PID 1676 wrote to memory of 1064 1676 backup.exe 35 PID 1676 wrote to memory of 1064 1676 backup.exe 35 PID 1676 wrote to memory of 1064 1676 backup.exe 35 PID 1676 wrote to memory of 1064 1676 backup.exe 35 PID 1064 wrote to memory of 1944 1064 backup.exe 36 PID 1064 wrote to memory of 1944 1064 backup.exe 36 PID 1064 wrote to memory of 1944 1064 backup.exe 36 PID 1064 wrote to memory of 1944 1064 backup.exe 36 PID 1676 wrote to memory of 2016 1676 backup.exe 37 PID 1676 wrote to memory of 2016 1676 backup.exe 37 PID 1676 wrote to memory of 2016 1676 backup.exe 37 PID 1676 wrote to memory of 2016 1676 backup.exe 37 PID 2016 wrote to memory of 832 2016 backup.exe 38 PID 2016 wrote to memory of 832 2016 backup.exe 38 PID 2016 wrote to memory of 832 2016 backup.exe 38 PID 2016 wrote to memory of 832 2016 backup.exe 38 PID 832 wrote to memory of 1760 832 backup.exe 39 PID 832 wrote to memory of 1760 832 backup.exe 39 PID 832 wrote to memory of 1760 832 backup.exe 39 PID 832 wrote to memory of 1760 832 backup.exe 39 PID 2016 wrote to memory of 1920 2016 backup.exe 40 PID 2016 wrote to memory of 1920 2016 backup.exe 40 PID 2016 wrote to memory of 1920 2016 backup.exe 40 PID 2016 wrote to memory of 1920 2016 backup.exe 40 PID 1920 wrote to memory of 840 1920 backup.exe 41 PID 1920 wrote to memory of 840 1920 backup.exe 41 PID 1920 wrote to memory of 840 1920 backup.exe 41 PID 1920 wrote to memory of 840 1920 backup.exe 41 PID 840 wrote to memory of 1264 840 backup.exe 42 PID 840 wrote to memory of 1264 840 backup.exe 42 PID 840 wrote to memory of 1264 840 backup.exe 42 PID 840 wrote to memory of 1264 840 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe"C:\Users\Admin\AppData\Local\Temp\6131f3da0f9cb5e94f44965783a865e438355e1fffbd790709cebe135fe80d3d.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\142354795\backup.exeC:\Users\Admin\AppData\Local\Temp\142354795\backup.exe C:\Users\Admin\AppData\Local\Temp\142354795\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1064 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:832 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1264
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1160 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1412
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:772
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- System policy modification
PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1380
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:1740
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1980 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- System policy modification
PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1624
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1228
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
PID:1296
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Disables RegEdit via registry modification
PID:676
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- System policy modification
PID:1964
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Drops file in Program Files directory
PID:1924 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
PID:1744
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:572
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1520 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1556
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:892
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1072
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1760
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Drops file in Program Files directory
- System policy modification
PID:860 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1636
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:2228
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- System policy modification
PID:308 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:1712
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:2108
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:760
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:1480
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Drops file in Program Files directory
PID:1572
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Program Files\Common Files\System\ado\update.exe"C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1048 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
PID:748
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:1212
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1940
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1916
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:832
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
PID:1612
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Disables RegEdit via registry modification
PID:1380
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1820
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:676
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1748
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2036
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2076
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2260
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2004 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
PID:1584
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
PID:1764
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
PID:1492
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1656
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
PID:624
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1956
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1760
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1600
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:660
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1568
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1588
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:744
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1044
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1060
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:1904
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1760
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:2196
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:2360
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:2504
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1480 -
C:\Program Files\Google\Chrome\update.exe"C:\Program Files\Google\Chrome\update.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1740 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Disables RegEdit via registry modification
PID:1156 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:268
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\update.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\update.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:2052
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1052 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1408
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- System policy modification
PID:772
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1068
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1620
-
-
C:\Program Files\Internet Explorer\images\System Restore.exe"C:\Program Files\Internet Explorer\images\System Restore.exe" C:\Program Files\Internet Explorer\images\6⤵
- Disables RegEdit via registry modification
PID:1060
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2252
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵PID:2388
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵PID:2520
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:584 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Disables RegEdit via registry modification
PID:1824 -
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:364
-
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵PID:1820
-
-
C:\Program Files\Java\jdk1.7.0_80\include\backup.exe"C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\7⤵PID:2092
-
-
C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe"C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\7⤵PID:2268
-
-
C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe"C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\7⤵PID:2400
-
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:1428
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1200
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:676
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2148
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2308
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2460
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2576
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1344 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:672 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:1608
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1824
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
PID:1912
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- System policy modification
PID:1044 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:2044
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:1248
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1736 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- System policy modification
PID:1592
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Disables RegEdit via registry modification
PID:1316
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Drops file in Program Files directory
PID:1408 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:1464
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Disables RegEdit via registry modification
PID:2008
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:436
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:1052
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- System policy modification
PID:1648
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1248 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵PID:1404
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:524
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1068
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Drops file in Program Files directory
PID:1704 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:816
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Disables RegEdit via registry modification
PID:1092
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1384
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1532 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Disables RegEdit via registry modification
PID:1620
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1940
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1212
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1868
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2140
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Drops file in Program Files directory
- System policy modification
PID:436 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:976
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
PID:1464 -
C:\Program Files (x86)\Common Files\Adobe\data.exe"C:\Program Files (x86)\Common Files\Adobe\data.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1932 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Disables RegEdit via registry modification
PID:524
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:2004
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵PID:2440
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1568
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\data.exe"C:\Program Files (x86)\Common Files\Adobe AIR\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:572 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- System policy modification
PID:2000 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵PID:1728
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- Disables RegEdit via registry modification
PID:1904
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
- Disables RegEdit via registry modification
PID:2020 -
C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\7⤵PID:1692
-
-
C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\7⤵PID:2068
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\7⤵PID:2236
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\7⤵PID:2380
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\7⤵PID:2512
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1228
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:1584
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2204
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1632 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1736
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1228
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:912
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1048
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
PID:1080 -
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:988
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:1648
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\System Restore.exe"C:\Program Files (x86)\Internet Explorer\es-ES\System Restore.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:760
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:2188
-
-
C:\Program Files (x86)\Internet Explorer\it-IT\System Restore.exe"C:\Program Files (x86)\Internet Explorer\it-IT\System Restore.exe" C:\Program Files (x86)\Internet Explorer\it-IT\6⤵PID:2352
-
-
C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\6⤵PID:2536
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:748
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵PID:1480
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\7⤵PID:1176
-
-
-
-
C:\Program Files (x86)\Microsoft Office\data.exe"C:\Program Files (x86)\Microsoft Office\data.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\data.exe"C:\Program Files (x86)\Microsoft Synchronization Services\data.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:2528
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1204
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1908
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Disables RegEdit via registry modification
PID:1556
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1696
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1404
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
PID:1940
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2168
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2324
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2488
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:944
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:560
-
-
C:\Users\Public\Downloads\data.exeC:\Users\Public\Downloads\data.exe C:\Users\Public\Downloads\6⤵PID:1920
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:1572
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:2084
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵PID:2244
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵PID:2372
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
- System policy modification
PID:1104 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1964
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1192
-
-
C:\Windows\AppPatch\update.exeC:\Windows\AppPatch\update.exe C:\Windows\AppPatch\5⤵PID:1924
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2220
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2408
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:2556
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1428
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD582f368e2e1ad2c29158cbf043d3c2315
SHA1ecd7b1a2d06e3a77998bee660d1a4d90e50a96a1
SHA256f21f92dd42315ec5a167af63285abd9f914ff7315bb9d148e57554d8da73a6a0
SHA512a472e7d67031b56df838e0445b18cf9ae62a71fdf90fc02c86142073911e6e410019b64ac525006b5d00227ca635ad02a2e563fea7926d8ff4a52a090db1a1d5
-
Filesize
72KB
MD5e16424a2621c00207d4f793dd4322242
SHA14e2d590bd761ae6a4fc66486ac7f285746c6742b
SHA256d6022647a40de540e4e312d3e5f1511f65cd379a4820d733bebc0bba3361becd
SHA512dcfdedb6ac4cae46c61d5d91a97488d84f932bdc8af59e145301db71813344991d83bbf16771d261157c6b9999c67cdfec274fb58272316fd6b159f7310324c9
-
Filesize
72KB
MD5e16424a2621c00207d4f793dd4322242
SHA14e2d590bd761ae6a4fc66486ac7f285746c6742b
SHA256d6022647a40de540e4e312d3e5f1511f65cd379a4820d733bebc0bba3361becd
SHA512dcfdedb6ac4cae46c61d5d91a97488d84f932bdc8af59e145301db71813344991d83bbf16771d261157c6b9999c67cdfec274fb58272316fd6b159f7310324c9
-
Filesize
72KB
MD5173ad112665dc4b8fa9fa1619d47af57
SHA1cea08fdefcb956ccb27cfcc5e6c5d0f245fb4679
SHA25646e2c676371bdfb7a674356c06eeb1e9ac055de85a875f600c0c28d8479abf8b
SHA512ba7067105fda74783dff32f8c8cdb3f7026fd7761e05104dec9e2ef7b4fec4ca373e6c4ec9ed71edb3fbfa5b1924887c7ce2a9b9406d5a2291a33014adb1ac01
-
Filesize
72KB
MD59e9b27785dfe225f5504652788f06b46
SHA1908f73a5b7118aca13fd1f30f44c77977bc1640a
SHA2560fe75172b2b56c985e4a7282e58a3866b2a6e6ee4b6102d799b8bc3a8e1ae1d8
SHA512bb7da9a613c25775f86dbcf3bd15dbd91b0a6537024bc989e282abeadc8e06a2462ef911815b6295031c8d06f4ac58f5abbbea7a951969168440f917032e401b
-
Filesize
72KB
MD59e9b27785dfe225f5504652788f06b46
SHA1908f73a5b7118aca13fd1f30f44c77977bc1640a
SHA2560fe75172b2b56c985e4a7282e58a3866b2a6e6ee4b6102d799b8bc3a8e1ae1d8
SHA512bb7da9a613c25775f86dbcf3bd15dbd91b0a6537024bc989e282abeadc8e06a2462ef911815b6295031c8d06f4ac58f5abbbea7a951969168440f917032e401b
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD510279e61477331105d8eab71c33b392b
SHA166783d0107c7d34af711bf82d6c01fe90f81088c
SHA2564d0ec8d37cd72879a2f9c48da63368c34092ee92bbb5dc49a71806b9bdfc7cd4
SHA51209996dc954c7b02f7ed14660079bbf281ee02fc74c7e31922ff8b9a0b8f52823f59c1516771bfe425f3c5c489b4cdc84bd4379c93577b11d5818634d32c69f6e
-
Filesize
72KB
MD510279e61477331105d8eab71c33b392b
SHA166783d0107c7d34af711bf82d6c01fe90f81088c
SHA2564d0ec8d37cd72879a2f9c48da63368c34092ee92bbb5dc49a71806b9bdfc7cd4
SHA51209996dc954c7b02f7ed14660079bbf281ee02fc74c7e31922ff8b9a0b8f52823f59c1516771bfe425f3c5c489b4cdc84bd4379c93577b11d5818634d32c69f6e
-
Filesize
72KB
MD54510fac406164c07e332308d4e4ea45e
SHA1111c139c1b7ae0f83739cdfd4573ccf9a6fae6ba
SHA25662318e865eedc349cc3d61f929397a163e6933a92cbcb170cf4d1f0638984ae8
SHA51271498eae31a553d0f20301b9e6b60b7b74225dcbea7e258049cdd0e91827a745bab1decfdd0e00cfc61226db3c64f24c0ff43d417041beb11910fdebeab5e013
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD54510fac406164c07e332308d4e4ea45e
SHA1111c139c1b7ae0f83739cdfd4573ccf9a6fae6ba
SHA25662318e865eedc349cc3d61f929397a163e6933a92cbcb170cf4d1f0638984ae8
SHA51271498eae31a553d0f20301b9e6b60b7b74225dcbea7e258049cdd0e91827a745bab1decfdd0e00cfc61226db3c64f24c0ff43d417041beb11910fdebeab5e013
-
Filesize
72KB
MD5375ee38a5b049b426c787dd12c53d5fc
SHA1e73329db57e154b7be750b3d41a857763f6610a2
SHA256675914d4b4d5fef52a1d9eaf6970794ff4e74cb533512adb34503ec2c6cd56d1
SHA512fa2812135a043cc731b44c19fc205050bd8c7bd33f1d5f0cb4cf159923f76a9dd0d076d932d24554d08f86d0f4bfc39ee45eb537f833a405eff251a4023d5619
-
Filesize
72KB
MD5375ee38a5b049b426c787dd12c53d5fc
SHA1e73329db57e154b7be750b3d41a857763f6610a2
SHA256675914d4b4d5fef52a1d9eaf6970794ff4e74cb533512adb34503ec2c6cd56d1
SHA512fa2812135a043cc731b44c19fc205050bd8c7bd33f1d5f0cb4cf159923f76a9dd0d076d932d24554d08f86d0f4bfc39ee45eb537f833a405eff251a4023d5619
-
Filesize
72KB
MD562234a47723e8e47be3a3512bffc76a7
SHA134444725ab5fe0fa39b8309c6b448f073752027f
SHA2565003aff909f86764a0c36034065c22bf590f0b7d595f5a3709b96868e91d3a28
SHA512d023f7d11bdad21c7fe94806fcee8df8463a9caccfabebc1fb3b0d0703283f3e46df7622979e8b1f490013f7ad09e11e4b4ff3339438ec51cec0a3b30813d2b2
-
Filesize
72KB
MD562234a47723e8e47be3a3512bffc76a7
SHA134444725ab5fe0fa39b8309c6b448f073752027f
SHA2565003aff909f86764a0c36034065c22bf590f0b7d595f5a3709b96868e91d3a28
SHA512d023f7d11bdad21c7fe94806fcee8df8463a9caccfabebc1fb3b0d0703283f3e46df7622979e8b1f490013f7ad09e11e4b4ff3339438ec51cec0a3b30813d2b2
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD59b9685d90ec4f3d524b74638fe2d978a
SHA1e5a19c6c24324f5c7fee16ea0bcbb6085c619ca0
SHA2563b9906d5d33b3b49e7403986e73b3ce2c8f06b86252fbece4c1abfc7f68d5a6f
SHA5129a04b650e68394a53d57278530a83eded8b5434f5e910cf98432204f7089b0d21751efba3d0cbba81547a8a59e45bb043305f83a23b2710ff2d58e3d09ebb2db
-
Filesize
72KB
MD59b9685d90ec4f3d524b74638fe2d978a
SHA1e5a19c6c24324f5c7fee16ea0bcbb6085c619ca0
SHA2563b9906d5d33b3b49e7403986e73b3ce2c8f06b86252fbece4c1abfc7f68d5a6f
SHA5129a04b650e68394a53d57278530a83eded8b5434f5e910cf98432204f7089b0d21751efba3d0cbba81547a8a59e45bb043305f83a23b2710ff2d58e3d09ebb2db
-
Filesize
72KB
MD582f368e2e1ad2c29158cbf043d3c2315
SHA1ecd7b1a2d06e3a77998bee660d1a4d90e50a96a1
SHA256f21f92dd42315ec5a167af63285abd9f914ff7315bb9d148e57554d8da73a6a0
SHA512a472e7d67031b56df838e0445b18cf9ae62a71fdf90fc02c86142073911e6e410019b64ac525006b5d00227ca635ad02a2e563fea7926d8ff4a52a090db1a1d5
-
Filesize
72KB
MD582f368e2e1ad2c29158cbf043d3c2315
SHA1ecd7b1a2d06e3a77998bee660d1a4d90e50a96a1
SHA256f21f92dd42315ec5a167af63285abd9f914ff7315bb9d148e57554d8da73a6a0
SHA512a472e7d67031b56df838e0445b18cf9ae62a71fdf90fc02c86142073911e6e410019b64ac525006b5d00227ca635ad02a2e563fea7926d8ff4a52a090db1a1d5
-
Filesize
72KB
MD5e16424a2621c00207d4f793dd4322242
SHA14e2d590bd761ae6a4fc66486ac7f285746c6742b
SHA256d6022647a40de540e4e312d3e5f1511f65cd379a4820d733bebc0bba3361becd
SHA512dcfdedb6ac4cae46c61d5d91a97488d84f932bdc8af59e145301db71813344991d83bbf16771d261157c6b9999c67cdfec274fb58272316fd6b159f7310324c9
-
Filesize
72KB
MD5e16424a2621c00207d4f793dd4322242
SHA14e2d590bd761ae6a4fc66486ac7f285746c6742b
SHA256d6022647a40de540e4e312d3e5f1511f65cd379a4820d733bebc0bba3361becd
SHA512dcfdedb6ac4cae46c61d5d91a97488d84f932bdc8af59e145301db71813344991d83bbf16771d261157c6b9999c67cdfec274fb58272316fd6b159f7310324c9
-
Filesize
72KB
MD5173ad112665dc4b8fa9fa1619d47af57
SHA1cea08fdefcb956ccb27cfcc5e6c5d0f245fb4679
SHA25646e2c676371bdfb7a674356c06eeb1e9ac055de85a875f600c0c28d8479abf8b
SHA512ba7067105fda74783dff32f8c8cdb3f7026fd7761e05104dec9e2ef7b4fec4ca373e6c4ec9ed71edb3fbfa5b1924887c7ce2a9b9406d5a2291a33014adb1ac01
-
Filesize
72KB
MD5173ad112665dc4b8fa9fa1619d47af57
SHA1cea08fdefcb956ccb27cfcc5e6c5d0f245fb4679
SHA25646e2c676371bdfb7a674356c06eeb1e9ac055de85a875f600c0c28d8479abf8b
SHA512ba7067105fda74783dff32f8c8cdb3f7026fd7761e05104dec9e2ef7b4fec4ca373e6c4ec9ed71edb3fbfa5b1924887c7ce2a9b9406d5a2291a33014adb1ac01
-
Filesize
72KB
MD59e9b27785dfe225f5504652788f06b46
SHA1908f73a5b7118aca13fd1f30f44c77977bc1640a
SHA2560fe75172b2b56c985e4a7282e58a3866b2a6e6ee4b6102d799b8bc3a8e1ae1d8
SHA512bb7da9a613c25775f86dbcf3bd15dbd91b0a6537024bc989e282abeadc8e06a2462ef911815b6295031c8d06f4ac58f5abbbea7a951969168440f917032e401b
-
Filesize
72KB
MD59e9b27785dfe225f5504652788f06b46
SHA1908f73a5b7118aca13fd1f30f44c77977bc1640a
SHA2560fe75172b2b56c985e4a7282e58a3866b2a6e6ee4b6102d799b8bc3a8e1ae1d8
SHA512bb7da9a613c25775f86dbcf3bd15dbd91b0a6537024bc989e282abeadc8e06a2462ef911815b6295031c8d06f4ac58f5abbbea7a951969168440f917032e401b
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD510279e61477331105d8eab71c33b392b
SHA166783d0107c7d34af711bf82d6c01fe90f81088c
SHA2564d0ec8d37cd72879a2f9c48da63368c34092ee92bbb5dc49a71806b9bdfc7cd4
SHA51209996dc954c7b02f7ed14660079bbf281ee02fc74c7e31922ff8b9a0b8f52823f59c1516771bfe425f3c5c489b4cdc84bd4379c93577b11d5818634d32c69f6e
-
Filesize
72KB
MD510279e61477331105d8eab71c33b392b
SHA166783d0107c7d34af711bf82d6c01fe90f81088c
SHA2564d0ec8d37cd72879a2f9c48da63368c34092ee92bbb5dc49a71806b9bdfc7cd4
SHA51209996dc954c7b02f7ed14660079bbf281ee02fc74c7e31922ff8b9a0b8f52823f59c1516771bfe425f3c5c489b4cdc84bd4379c93577b11d5818634d32c69f6e
-
Filesize
72KB
MD54510fac406164c07e332308d4e4ea45e
SHA1111c139c1b7ae0f83739cdfd4573ccf9a6fae6ba
SHA25662318e865eedc349cc3d61f929397a163e6933a92cbcb170cf4d1f0638984ae8
SHA51271498eae31a553d0f20301b9e6b60b7b74225dcbea7e258049cdd0e91827a745bab1decfdd0e00cfc61226db3c64f24c0ff43d417041beb11910fdebeab5e013
-
Filesize
72KB
MD54510fac406164c07e332308d4e4ea45e
SHA1111c139c1b7ae0f83739cdfd4573ccf9a6fae6ba
SHA25662318e865eedc349cc3d61f929397a163e6933a92cbcb170cf4d1f0638984ae8
SHA51271498eae31a553d0f20301b9e6b60b7b74225dcbea7e258049cdd0e91827a745bab1decfdd0e00cfc61226db3c64f24c0ff43d417041beb11910fdebeab5e013
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD5e86c1da59a1e7795b5da461aac48c482
SHA185eda2bb05341d47836338ef596a791a43a7c743
SHA256a9aa0e463d9417c57481618f4f931f37f2cea4b8c4a1196b7e30e272611f2d78
SHA512c847db418db87ed667427a9698a6e37b02f1c5770c2ae4c39cc9bc66d8bc76abc23901f78f05060b4fcefb3692bd1121316afe75f11ebfc467f923382173b9ee
-
Filesize
72KB
MD54510fac406164c07e332308d4e4ea45e
SHA1111c139c1b7ae0f83739cdfd4573ccf9a6fae6ba
SHA25662318e865eedc349cc3d61f929397a163e6933a92cbcb170cf4d1f0638984ae8
SHA51271498eae31a553d0f20301b9e6b60b7b74225dcbea7e258049cdd0e91827a745bab1decfdd0e00cfc61226db3c64f24c0ff43d417041beb11910fdebeab5e013
-
Filesize
72KB
MD54510fac406164c07e332308d4e4ea45e
SHA1111c139c1b7ae0f83739cdfd4573ccf9a6fae6ba
SHA25662318e865eedc349cc3d61f929397a163e6933a92cbcb170cf4d1f0638984ae8
SHA51271498eae31a553d0f20301b9e6b60b7b74225dcbea7e258049cdd0e91827a745bab1decfdd0e00cfc61226db3c64f24c0ff43d417041beb11910fdebeab5e013
-
Filesize
72KB
MD5b3d77ad02375249f63f88c9a63169a72
SHA129b55c164cd3937279ffd763e0c1cca7952c2ea4
SHA256840b82294cf8b7968e10aa959eab03de5ecc7c968c6164af886a9f2bfcdbae94
SHA5129869c90d1c5d222ab893aa8b6273447a6970877ee84f69f10162d9338ef0151bdadf25864d6b9112799c9212d276f0aa38639720de0ee830b342192cb82bc1bd
-
Filesize
72KB
MD5375ee38a5b049b426c787dd12c53d5fc
SHA1e73329db57e154b7be750b3d41a857763f6610a2
SHA256675914d4b4d5fef52a1d9eaf6970794ff4e74cb533512adb34503ec2c6cd56d1
SHA512fa2812135a043cc731b44c19fc205050bd8c7bd33f1d5f0cb4cf159923f76a9dd0d076d932d24554d08f86d0f4bfc39ee45eb537f833a405eff251a4023d5619
-
Filesize
72KB
MD5375ee38a5b049b426c787dd12c53d5fc
SHA1e73329db57e154b7be750b3d41a857763f6610a2
SHA256675914d4b4d5fef52a1d9eaf6970794ff4e74cb533512adb34503ec2c6cd56d1
SHA512fa2812135a043cc731b44c19fc205050bd8c7bd33f1d5f0cb4cf159923f76a9dd0d076d932d24554d08f86d0f4bfc39ee45eb537f833a405eff251a4023d5619
-
Filesize
72KB
MD562234a47723e8e47be3a3512bffc76a7
SHA134444725ab5fe0fa39b8309c6b448f073752027f
SHA2565003aff909f86764a0c36034065c22bf590f0b7d595f5a3709b96868e91d3a28
SHA512d023f7d11bdad21c7fe94806fcee8df8463a9caccfabebc1fb3b0d0703283f3e46df7622979e8b1f490013f7ad09e11e4b4ff3339438ec51cec0a3b30813d2b2
-
Filesize
72KB
MD562234a47723e8e47be3a3512bffc76a7
SHA134444725ab5fe0fa39b8309c6b448f073752027f
SHA2565003aff909f86764a0c36034065c22bf590f0b7d595f5a3709b96868e91d3a28
SHA512d023f7d11bdad21c7fe94806fcee8df8463a9caccfabebc1fb3b0d0703283f3e46df7622979e8b1f490013f7ad09e11e4b4ff3339438ec51cec0a3b30813d2b2
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58d5ce24c2304e16130ed8d5cc37b52c7
SHA1e9dd5029d1add35a1d17a6c22afc65bbd494276c
SHA256a6100f0ffaf6d0a171d2cbca4331a23afe3278181587698955484024dd12d720
SHA512266023265dcc783c25ea0d9abba16a0b59a32563db0bf9f0fb40717c57b5edae88525f15f1de0b45792a72ac0e224cdba21c5f78d00cb9af52595fc0f6cfdb20
-
Filesize
72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742
-
Filesize
72KB
MD58297f74b5ef2dc5f9f4b631888a4e310
SHA16d7695b0dbc9b1400e59cce2abe01f708c79aa35
SHA256cf73b3782b16bb4f5d9f0b3bfe8f553b2eebddb1640a565ad33a892e749755b8
SHA5123c685c243301f80fcf83bf30f7c0798796668ac50a20ee127366b95020433ae4216b718c41093eee480c7b66cb9b9653833e1601d009b1174ea0817d56f97742