Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe
Resource
win10v2004-20220812-en
General
-
Target
a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe
-
Size
72KB
-
MD5
009f9f02b54223bfbc2a6ae138992d41
-
SHA1
47e7cbb81fb08448536911e0f82a7074aa24779d
-
SHA256
a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267
-
SHA512
623b702a3e89964c29394dbe3968844aeeae986478455afe216a818e829de38c287a6344852c2311d59ca77ee5ea1f76a4f1f22be8a51b2fb1fdfb413d3d96bd
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2j:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1216 backup.exe 1532 backup.exe 1344 backup.exe 1480 backup.exe 1552 backup.exe 520 backup.exe 1584 backup.exe 976 backup.exe 932 backup.exe 1324 backup.exe 808 backup.exe 1712 backup.exe 1328 data.exe 1700 backup.exe 756 data.exe 1820 backup.exe 1528 backup.exe 1704 backup.exe 1648 backup.exe 920 backup.exe 1036 backup.exe 876 backup.exe 1692 backup.exe 1688 backup.exe 1544 backup.exe 1616 backup.exe 1032 backup.exe 588 backup.exe 1508 backup.exe 824 backup.exe 1156 backup.exe 1324 backup.exe 1752 backup.exe 1804 backup.exe 1948 backup.exe 796 backup.exe 1396 backup.exe 1668 backup.exe 112 backup.exe 1356 backup.exe 1228 backup.exe 1272 backup.exe 884 backup.exe 1568 backup.exe 956 backup.exe 592 backup.exe 1652 backup.exe 1480 backup.exe 876 backup.exe 872 backup.exe 1688 backup.exe 1608 backup.exe 1604 backup.exe 1716 backup.exe 1384 backup.exe 2008 backup.exe 904 backup.exe 560 backup.exe 2020 backup.exe 932 backup.exe 1372 backup.exe 1416 backup.exe 1328 backup.exe 1408 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 976 backup.exe 976 backup.exe 932 backup.exe 932 backup.exe 976 backup.exe 976 backup.exe 808 backup.exe 808 backup.exe 1712 backup.exe 1712 backup.exe 808 backup.exe 808 backup.exe 1700 backup.exe 1700 backup.exe 756 data.exe 756 data.exe 756 data.exe 756 data.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1528 backup.exe 1508 backup.exe 1508 backup.exe 1508 backup.exe 1508 backup.exe 1508 backup.exe 1508 backup.exe 1508 backup.exe 1508 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe data.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\update.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\data.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe data.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\update.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe data.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\CSC\backup.exe backup.exe File opened for modification C:\Windows\Cursors\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 1216 backup.exe 1532 backup.exe 1344 backup.exe 1480 backup.exe 1552 backup.exe 520 backup.exe 1584 backup.exe 976 backup.exe 932 backup.exe 1324 backup.exe 808 backup.exe 1712 backup.exe 1328 data.exe 1700 backup.exe 756 data.exe 1820 backup.exe 1528 backup.exe 1704 backup.exe 1648 backup.exe 920 backup.exe 1036 backup.exe 876 backup.exe 1692 backup.exe 1688 backup.exe 1544 backup.exe 1616 backup.exe 1032 backup.exe 588 backup.exe 1508 backup.exe 824 backup.exe 1156 backup.exe 1324 backup.exe 1752 backup.exe 1804 backup.exe 1948 backup.exe 796 backup.exe 1396 backup.exe 1668 backup.exe 112 backup.exe 1356 backup.exe 1228 backup.exe 1272 backup.exe 884 backup.exe 1568 backup.exe 1652 backup.exe 1480 backup.exe 592 backup.exe 956 backup.exe 876 backup.exe 872 backup.exe 1608 backup.exe 560 backup.exe 1384 backup.exe 1716 backup.exe 2020 backup.exe 932 backup.exe 904 backup.exe 2008 backup.exe 1688 backup.exe 1604 backup.exe 1328 backup.exe 1408 backup.exe 1416 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1216 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 28 PID 1636 wrote to memory of 1216 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 28 PID 1636 wrote to memory of 1216 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 28 PID 1636 wrote to memory of 1216 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 28 PID 1636 wrote to memory of 1532 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 29 PID 1636 wrote to memory of 1532 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 29 PID 1636 wrote to memory of 1532 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 29 PID 1636 wrote to memory of 1532 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 29 PID 1636 wrote to memory of 1344 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 30 PID 1636 wrote to memory of 1344 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 30 PID 1636 wrote to memory of 1344 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 30 PID 1636 wrote to memory of 1344 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 30 PID 1636 wrote to memory of 1480 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 31 PID 1636 wrote to memory of 1480 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 31 PID 1636 wrote to memory of 1480 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 31 PID 1636 wrote to memory of 1480 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 31 PID 1636 wrote to memory of 1552 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 32 PID 1636 wrote to memory of 1552 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 32 PID 1636 wrote to memory of 1552 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 32 PID 1636 wrote to memory of 1552 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 32 PID 1636 wrote to memory of 520 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 33 PID 1636 wrote to memory of 520 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 33 PID 1636 wrote to memory of 520 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 33 PID 1636 wrote to memory of 520 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 33 PID 1636 wrote to memory of 1584 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 34 PID 1636 wrote to memory of 1584 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 34 PID 1636 wrote to memory of 1584 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 34 PID 1636 wrote to memory of 1584 1636 a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe 34 PID 1216 wrote to memory of 976 1216 backup.exe 35 PID 1216 wrote to memory of 976 1216 backup.exe 35 PID 1216 wrote to memory of 976 1216 backup.exe 35 PID 1216 wrote to memory of 976 1216 backup.exe 35 PID 976 wrote to memory of 932 976 backup.exe 36 PID 976 wrote to memory of 932 976 backup.exe 36 PID 976 wrote to memory of 932 976 backup.exe 36 PID 976 wrote to memory of 932 976 backup.exe 36 PID 932 wrote to memory of 1324 932 backup.exe 37 PID 932 wrote to memory of 1324 932 backup.exe 37 PID 932 wrote to memory of 1324 932 backup.exe 37 PID 932 wrote to memory of 1324 932 backup.exe 37 PID 976 wrote to memory of 808 976 backup.exe 38 PID 976 wrote to memory of 808 976 backup.exe 38 PID 976 wrote to memory of 808 976 backup.exe 38 PID 976 wrote to memory of 808 976 backup.exe 38 PID 808 wrote to memory of 1712 808 backup.exe 39 PID 808 wrote to memory of 1712 808 backup.exe 39 PID 808 wrote to memory of 1712 808 backup.exe 39 PID 808 wrote to memory of 1712 808 backup.exe 39 PID 1712 wrote to memory of 1328 1712 backup.exe 40 PID 1712 wrote to memory of 1328 1712 backup.exe 40 PID 1712 wrote to memory of 1328 1712 backup.exe 40 PID 1712 wrote to memory of 1328 1712 backup.exe 40 PID 808 wrote to memory of 1700 808 backup.exe 41 PID 808 wrote to memory of 1700 808 backup.exe 41 PID 808 wrote to memory of 1700 808 backup.exe 41 PID 808 wrote to memory of 1700 808 backup.exe 41 PID 1700 wrote to memory of 756 1700 backup.exe 42 PID 1700 wrote to memory of 756 1700 backup.exe 42 PID 1700 wrote to memory of 756 1700 backup.exe 42 PID 1700 wrote to memory of 756 1700 backup.exe 42 PID 756 wrote to memory of 1820 756 data.exe 43 PID 756 wrote to memory of 1820 756 data.exe 43 PID 756 wrote to memory of 1820 756 data.exe 43 PID 756 wrote to memory of 1820 756 data.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe"C:\Users\Admin\AppData\Local\Temp\a430e34ed5b12ea3cba775ebdc4ed6990f13cc8f08ed430a3ef377e1a2b21267.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3553599215\backup.exeC:\Users\Admin\AppData\Local\Temp\3553599215\backup.exe C:\Users\Admin\AppData\Local\Temp\3553599215\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1216 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\7-Zip\Lang\data.exe"C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1328
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Common Files\Microsoft Shared\data.exe"C:\Program Files\Common Files\Microsoft Shared\data.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1820
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:876
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1508 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1668
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1356
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1228
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1232
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:2076
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:2256
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:2540
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:956 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1416
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:432
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:572
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1500
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1168
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1096
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2264
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2620
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1568
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:876 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:860 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1032 -
C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe"C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1832
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:2052
-
-
C:\Program Files\Common Files\System\ado\es-ES\System Restore.exe"C:\Program Files\Common Files\System\ado\es-ES\System Restore.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:2192
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:2524
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1728
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1836
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1780
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2208
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2580
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:884 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1356
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1828
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1732
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1356
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:2116
-
-
C:\Program Files\DVD Maker\Shared\update.exe"C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:2508
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1716 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1408 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1684 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1184
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:2596
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1164
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1740
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1496
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1672
-
-
C:\Program Files\Microsoft Office\update.exe"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\5⤵PID:2004
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2224
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2612
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1272 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:592 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1608 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1372
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵PID:1412
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1556
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:2060
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:560 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\data.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\data.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1168
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1744
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1748
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\update.exe"C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1372
-
-
C:\Program Files (x86)\Common Files\DESIGNER\System Restore.exe"C:\Program Files (x86)\Common Files\DESIGNER\System Restore.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2084
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2248
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2588
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:2024
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:364
-
-
C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe"C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2604
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
PID:1164
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:528
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:972
-
-
C:\Users\Admin\Downloads\System Restore.exe"C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\6⤵PID:872
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1704
-
-
C:\Users\Admin\Links\update.exeC:\Users\Admin\Links\update.exe C:\Users\Admin\Links\6⤵PID:2232
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2532
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1880
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:904 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1084
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1540
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1924
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:752
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:824
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵PID:672
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵PID:2216
-
-
C:\Windows\debug\backup.exeC:\Windows\debug\backup.exe C:\Windows\debug\5⤵PID:2548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1344
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1480
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1584
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD54b9bf6037ee6690f8554c1d5aa9a5386
SHA189efd6b5108427c05e4901aa43f58ffb80b3e367
SHA256e7b8f30bebb4b056c18c86f8e67daf1ea49c5a039b901fbdcd9887cd28109f70
SHA512c82649957ea2bc5a719d44e9a9c72520fa7ecb9981ff887618cb252471eb543433b00156b9b4d991429864d156d1b1666cc5f34fa89fdbe8f28b50417b1ae964
-
Filesize
72KB
MD54b9bf6037ee6690f8554c1d5aa9a5386
SHA189efd6b5108427c05e4901aa43f58ffb80b3e367
SHA256e7b8f30bebb4b056c18c86f8e67daf1ea49c5a039b901fbdcd9887cd28109f70
SHA512c82649957ea2bc5a719d44e9a9c72520fa7ecb9981ff887618cb252471eb543433b00156b9b4d991429864d156d1b1666cc5f34fa89fdbe8f28b50417b1ae964
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD5aecd5edcdc300324ecb85647e741c6c7
SHA1bd14ef896f24f40ee015222521f19b04a6d45498
SHA256b889453c7a383f7c32837b2939d5d5a7dbb7833229cf7df7e1b4f84ac8a4ae54
SHA5126e265ef360220d1cd7991aef989e657340a48f1aee5e35b06eff58e1e8904141f37b3d9003e99a22496bf85b379368e0f3e3d800b53549429f6c3a1482b91f9d
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5c36a647aefbc42636b3ed95e21752f91
SHA157ac6f87add8a57fa0865d5359587d7680c4cae4
SHA256e0b21693db52a2abd9237f2dc8e987688644ac7d837ec947c1f8fac4d2f0e039
SHA5120dc847469b23b9d77b5a4142318f24dc6407671e88063e6af5db3e1690f0244fa9b6698e15fc3b6ed8e73da57b42a4e302757135180a061f735c28a11c631ccc
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD5b6812aea141e434afd3c3d2fa512bd73
SHA1f20fc19e47143a29cd743bbace96aeb14683d27e
SHA25646a4f1dcccf96e68ab3f95b8592dfa145182bae363c4da088690dbb696e6270f
SHA512419352549dc778470704de82e536538070e88668ee3c5ac8b3ebea5cfcc9929e83834b67f31a3ba287d7ff8f025938ae444d96adbaa157ca4ceeab6fc41cbffb
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD594dfe2185024a582a2e7658eb56695af
SHA16c54815402964a732cf0cec7768f1b9f3d7060a4
SHA256ae6d6c7639d8b4fd13f0c3a0f1edab1f61af5d0668f0fdba150317a3453b9eb9
SHA51243adad9b8eabce1327da7906921c36b0d1b0dd7bb2c125b14320bdc2f7855c35db991cfe865913d8092fcacbd4af5e89c13d91292369db4e4354cfab8ba6730b
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD5d4045ac5397f7742c22bca9ff2cc1742
SHA1b79694dc341c47965547fdab4ec187b6fe24a9ff
SHA2562ec9f98b4c8f0c20e9ba367c6ae631d8872d39172600ff91875cc44a998478c5
SHA512827a1de10ab86d73a6d090bfb9659cb8ec3eaf1bdbf9246615289363d66f050fc04c2717d2e80cda6b27e03131664a8b56d9dcdec18943a492dab055a9b42f62
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51300d7816358d9c2192b5139ea260b6f
SHA1d049a1e5c7361ee6b9f9b0743ec38a0208781c9c
SHA256f1c01878a82134d5303e272c1a8cd1a16bab14edac96b82f6e36e2227f52b0b0
SHA512657a7aeecb7596e59f8fe9ef1a9efd8bb2b5bd64442ca2bcd59b2b3b64ce68dafa06a7ed470ca5b3b84c3569bee61a4fb23c259d4e08c56544ade6c8e18834f7
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2
-
Filesize
72KB
MD51aca594d53905a056c916264172fd456
SHA118f88714dd667fa624fc3accb0b749c4fb5af13f
SHA2560d8b491b43b2ee980c1f866231ca82a3a1a8354e399f5677c992d282092c0e3b
SHA5123e4e175e0a9b2fbf9a72875d9bff66527c495a5d635cbad188ba670162556815d26ccca856e6c14e40a925c752fe5a5d93f7f68c82b4b67d2ea98e1d8bf883d2