Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe
Resource
win10v2004-20220812-en
General
-
Target
ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe
-
Size
72KB
-
MD5
60044433f66464b86a9c16c269221497
-
SHA1
d03211ff0fd444f291afe6f5b12b537687ff3537
-
SHA256
ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f
-
SHA512
73ca3d8b7277d0d0bbb7f08123feaecfbecb3f6224675517dbbcca252a0409a23990898d163c5a2e0b96978647b12f8ad2c2a9a3d1c3c50c1ae0d0d9ae4bfe7c
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2g:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrc
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2012 backup.exe 1488 backup.exe 1592 backup.exe 1480 backup.exe 1252 backup.exe 1824 backup.exe 760 System Restore.exe 1080 backup.exe 1788 backup.exe 1384 backup.exe 1144 backup.exe 1976 backup.exe 1048 backup.exe 1796 backup.exe 1668 data.exe 568 backup.exe 2040 backup.exe 764 backup.exe 916 backup.exe 1604 backup.exe 1640 backup.exe 1496 backup.exe 1268 backup.exe 1488 backup.exe 1444 backup.exe 1468 backup.exe 1980 backup.exe 1380 data.exe 1704 backup.exe 1544 backup.exe 948 backup.exe 1260 backup.exe 1184 backup.exe 1924 backup.exe 1744 backup.exe 1972 backup.exe 1952 backup.exe 684 backup.exe 1784 backup.exe 1120 backup.exe 1796 backup.exe 340 backup.exe 1472 backup.exe 1772 System Restore.exe 108 backup.exe 568 backup.exe 764 backup.exe 1760 backup.exe 1988 backup.exe 972 backup.exe 2028 backup.exe 1560 backup.exe 1076 backup.exe 1488 backup.exe 1724 backup.exe 1460 backup.exe 988 backup.exe 1596 update.exe 1036 backup.exe 1712 backup.exe 1540 backup.exe 1072 backup.exe 2024 backup.exe 1532 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1480 backup.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1480 backup.exe 1824 backup.exe 1824 backup.exe 1480 backup.exe 1480 backup.exe 1788 backup.exe 1788 backup.exe 1384 backup.exe 1384 backup.exe 1788 backup.exe 1788 backup.exe 1976 backup.exe 1976 backup.exe 1048 backup.exe 1048 backup.exe 1048 backup.exe 1048 backup.exe 1668 data.exe 1668 data.exe 1668 data.exe 1668 data.exe 1668 data.exe 1668 data.exe 1668 data.exe 1668 data.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1668 data.exe 1668 data.exe 1668 data.exe 1668 data.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 1668 data.exe 1668 data.exe 1480 backup.exe 1480 backup.exe 1668 data.exe 1668 data.exe 1444 backup.exe 1444 backup.exe 1668 data.exe 1668 data.exe 1980 backup.exe 1980 backup.exe 1704 backup.exe 1704 backup.exe 1668 data.exe 1668 data.exe 1976 backup.exe 1976 backup.exe 1788 backup.exe 1788 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe data.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe data.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 2012 backup.exe 1488 backup.exe 1592 backup.exe 1480 backup.exe 1252 backup.exe 1824 backup.exe 760 System Restore.exe 1080 backup.exe 1788 backup.exe 1384 backup.exe 1144 backup.exe 1976 backup.exe 1048 backup.exe 1796 backup.exe 1668 data.exe 568 backup.exe 2040 backup.exe 764 backup.exe 1604 backup.exe 1640 backup.exe 1268 backup.exe 1496 backup.exe 1488 backup.exe 1444 backup.exe 1468 backup.exe 1980 backup.exe 1380 data.exe 1704 backup.exe 1544 backup.exe 948 backup.exe 1260 backup.exe 1184 backup.exe 1924 backup.exe 1744 backup.exe 1972 backup.exe 1952 backup.exe 1784 backup.exe 684 backup.exe 1120 backup.exe 1796 backup.exe 1472 backup.exe 568 backup.exe 340 backup.exe 108 backup.exe 1772 System Restore.exe 764 backup.exe 1760 backup.exe 1988 backup.exe 972 backup.exe 2028 backup.exe 1560 backup.exe 1076 backup.exe 1488 backup.exe 1724 backup.exe 1460 backup.exe 988 backup.exe 1036 backup.exe 1712 backup.exe 1072 backup.exe 2024 backup.exe 612 backup.exe 1012 backup.exe 1120 data.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1764 wrote to memory of 2012 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 26 PID 1764 wrote to memory of 2012 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 26 PID 1764 wrote to memory of 2012 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 26 PID 1764 wrote to memory of 2012 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 26 PID 1764 wrote to memory of 1488 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 27 PID 1764 wrote to memory of 1488 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 27 PID 1764 wrote to memory of 1488 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 27 PID 1764 wrote to memory of 1488 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 27 PID 1764 wrote to memory of 1592 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 28 PID 1764 wrote to memory of 1592 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 28 PID 1764 wrote to memory of 1592 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 28 PID 1764 wrote to memory of 1592 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 28 PID 2012 wrote to memory of 1480 2012 backup.exe 29 PID 2012 wrote to memory of 1480 2012 backup.exe 29 PID 2012 wrote to memory of 1480 2012 backup.exe 29 PID 2012 wrote to memory of 1480 2012 backup.exe 29 PID 1764 wrote to memory of 1252 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 30 PID 1764 wrote to memory of 1252 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 30 PID 1764 wrote to memory of 1252 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 30 PID 1764 wrote to memory of 1252 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 30 PID 1764 wrote to memory of 760 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 31 PID 1764 wrote to memory of 760 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 31 PID 1764 wrote to memory of 760 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 31 PID 1764 wrote to memory of 760 1764 ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe 31 PID 1480 wrote to memory of 1824 1480 backup.exe 32 PID 1480 wrote to memory of 1824 1480 backup.exe 32 PID 1480 wrote to memory of 1824 1480 backup.exe 32 PID 1480 wrote to memory of 1824 1480 backup.exe 32 PID 1824 wrote to memory of 1080 1824 backup.exe 33 PID 1824 wrote to memory of 1080 1824 backup.exe 33 PID 1824 wrote to memory of 1080 1824 backup.exe 33 PID 1824 wrote to memory of 1080 1824 backup.exe 33 PID 1480 wrote to memory of 1788 1480 backup.exe 34 PID 1480 wrote to memory of 1788 1480 backup.exe 34 PID 1480 wrote to memory of 1788 1480 backup.exe 34 PID 1480 wrote to memory of 1788 1480 backup.exe 34 PID 1788 wrote to memory of 1384 1788 backup.exe 35 PID 1788 wrote to memory of 1384 1788 backup.exe 35 PID 1788 wrote to memory of 1384 1788 backup.exe 35 PID 1788 wrote to memory of 1384 1788 backup.exe 35 PID 1384 wrote to memory of 1144 1384 backup.exe 36 PID 1384 wrote to memory of 1144 1384 backup.exe 36 PID 1384 wrote to memory of 1144 1384 backup.exe 36 PID 1384 wrote to memory of 1144 1384 backup.exe 36 PID 1788 wrote to memory of 1976 1788 backup.exe 37 PID 1788 wrote to memory of 1976 1788 backup.exe 37 PID 1788 wrote to memory of 1976 1788 backup.exe 37 PID 1788 wrote to memory of 1976 1788 backup.exe 37 PID 1976 wrote to memory of 1048 1976 backup.exe 38 PID 1976 wrote to memory of 1048 1976 backup.exe 38 PID 1976 wrote to memory of 1048 1976 backup.exe 38 PID 1976 wrote to memory of 1048 1976 backup.exe 38 PID 1048 wrote to memory of 1796 1048 backup.exe 39 PID 1048 wrote to memory of 1796 1048 backup.exe 39 PID 1048 wrote to memory of 1796 1048 backup.exe 39 PID 1048 wrote to memory of 1796 1048 backup.exe 39 PID 1048 wrote to memory of 1668 1048 backup.exe 40 PID 1048 wrote to memory of 1668 1048 backup.exe 40 PID 1048 wrote to memory of 1668 1048 backup.exe 40 PID 1048 wrote to memory of 1668 1048 backup.exe 40 PID 1668 wrote to memory of 568 1668 data.exe 41 PID 1668 wrote to memory of 568 1668 data.exe 41 PID 1668 wrote to memory of 568 1668 data.exe 41 PID 1668 wrote to memory of 568 1668 data.exe 41 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe"C:\Users\Admin\AppData\Local\Temp\ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1350449190\backup.exeC:\Users\Admin\AppData\Local\Temp\1350449190\backup.exe C:\Users\Admin\AppData\Local\Temp\1350449190\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1480 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1824 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1080
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1788 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1384 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1144
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1976 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1668 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1640
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1772
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:2076
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:2240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:2344
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:2116
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:2232
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:2336
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:340 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1572
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2136
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\data.exe"C:\Program Files\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:2268
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2388
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1784
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1472 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:612
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:568
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1712
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1768
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1180
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1748
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1380
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1528
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1260
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2152
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2284
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1184 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:684
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1728
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1464
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:948
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
PID:1540
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:380
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1664
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1964
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2100
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2260
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1444 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:108
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:684
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1524
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1744
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1100
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:2108
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:2200
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:2380
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1072 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1580
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1012
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2128
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:872
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:988 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Executes dropped EXE
PID:1532
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1708
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1396
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1688
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2092
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:2208
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2360
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1056 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:2324
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2252
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1076 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1036 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1780
-
-
C:\Users\Admin\Desktop\update.exeC:\Users\Admin\Desktop\update.exe C:\Users\Admin\Desktop\6⤵PID:2032
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:2008
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1996
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2084
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2224
-
-
C:\Users\Admin\Music\data.exeC:\Users\Admin\Music\data.exe C:\Users\Admin\Music\6⤵PID:2352
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1052
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:968 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1020
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:972
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:2216
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2312
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1488
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1252
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1268
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD532350becc952b3a9919a2550dcd91bf6
SHA19eeffe4bed46a7e12689c4952a8cc2e1caf72362
SHA256510e8c3dda959a4b20a6af0284cac0e2d894049e470a0b7da66930001bf742fa
SHA512cc0366306b3427f726db97510fae060a7f5f480c2c6aedfb6621c19770daf76dbde66ad535c66caf0c32994bc3929af20348761574aab5c43a3b8d4608dae04c
-
Filesize
72KB
MD5cd0debb6656a422bad56b230e9f0fa3a
SHA1c318460efeea117a6f385e68a2d3acfb07265cb7
SHA256318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46
SHA512a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f
-
Filesize
72KB
MD5cd0debb6656a422bad56b230e9f0fa3a
SHA1c318460efeea117a6f385e68a2d3acfb07265cb7
SHA256318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46
SHA512a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f
-
Filesize
72KB
MD564e7421265bea861b3d87f7549a17e73
SHA15dcd7665fceb4477d5e04a46cb775c17fa203ea1
SHA2560c91e30ab689c1d608983ba9d8f6de6884a3b6f82fc7f1c146417fcd71402215
SHA5123b52fc295f0734e589447f6c6ee6c1f9d1bc54e812ac32dcd5c18b95f852da8307600cef22bc91ed515a0b4a40b8ad213334e27af3fff46aa6472ab0a2c1da97
-
Filesize
72KB
MD5aa59de42bb02c54924b84a1ae56f8ead
SHA1801801c94bb6540f8ecb824be60e599d293fd9f0
SHA256aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721
SHA51288d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb
-
Filesize
72KB
MD5aa59de42bb02c54924b84a1ae56f8ead
SHA1801801c94bb6540f8ecb824be60e599d293fd9f0
SHA256aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721
SHA51288d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb
-
Filesize
72KB
MD5de7da1787c3f02b7d5b918595c803859
SHA1876cf63967a1ee8652b66c7b34aea39cd1be8947
SHA256aca5f4e65a8e4f2469102a14d5519e72d543c84b1d1f934b3698703192287e4d
SHA5121b5a2d56efe569e59839cd0a80075649745745abcfa6e8076b8301adfcc1b4b264ec0179d96f87fdabe0cb077ca25a3360d7ed4cb5fa7201da703ac249e90fa9
-
Filesize
72KB
MD5e38fc6d23fd2d40ac2d461b5c2c97a90
SHA108c39b905a27b3a6956039c35557fe86a96d5717
SHA256faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a
SHA51292175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696
-
Filesize
72KB
MD5e38fc6d23fd2d40ac2d461b5c2c97a90
SHA108c39b905a27b3a6956039c35557fe86a96d5717
SHA256faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a
SHA51292175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD50d12972d15db80dcfc525cf3f218fe47
SHA14d629606be8d7811d1b72639cae1dc31b0629577
SHA2569946cd1aa501ed442b19dc292e632cb6771742d5c977a19ee3aebea4e803ea1a
SHA5123d15ee11de42176b44d4535914f042aa7abd59283d7858bccc27693df4a1c42022aec3c3013cbe3329993d86590a5d53e2f8a0ee9890264d4f04ef3712fc187c
-
Filesize
72KB
MD5f65c69e2d2095dcfb78080d0bfd92e2b
SHA1e556195e1a420b9d1dc86506f8a5080c906407de
SHA2568b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558
SHA512fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32
-
Filesize
72KB
MD5f65c69e2d2095dcfb78080d0bfd92e2b
SHA1e556195e1a420b9d1dc86506f8a5080c906407de
SHA2568b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558
SHA512fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32
-
Filesize
72KB
MD5bcf7ebd80ba544925ab058160f276ed8
SHA1d79e5ebee9f54d4d47f42e78232729416cf64338
SHA256a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9
SHA512b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5
-
Filesize
72KB
MD5bcf7ebd80ba544925ab058160f276ed8
SHA1d79e5ebee9f54d4d47f42e78232729416cf64338
SHA256a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9
SHA512b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5
-
Filesize
72KB
MD5bbf7c143fba23a6ecc6af279eb42d707
SHA164ee2b5d56d14dfd127f60f7191e92b48032bd01
SHA2563f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510
SHA512efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903
-
Filesize
72KB
MD5bbf7c143fba23a6ecc6af279eb42d707
SHA164ee2b5d56d14dfd127f60f7191e92b48032bd01
SHA2563f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510
SHA512efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903
-
Filesize
72KB
MD58c8edfe082247d1025585dd714cdc0e5
SHA101e59bab2877b687581bc8c46a803500400af220
SHA256e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09
SHA5129e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6
-
Filesize
72KB
MD58c8edfe082247d1025585dd714cdc0e5
SHA101e59bab2877b687581bc8c46a803500400af220
SHA256e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09
SHA5129e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6
-
Filesize
72KB
MD58f042508fe60117e425c69088be0a357
SHA129c9bf4df911e8011a4abaa09c3d1d5c2115f3dd
SHA2562722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77
SHA512e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58f042508fe60117e425c69088be0a357
SHA129c9bf4df911e8011a4abaa09c3d1d5c2115f3dd
SHA2562722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77
SHA512e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5e6492ee8990f05bacfd1a80c2be42bcc
SHA178bb078dac21435ccaaa0712bddf0202aabe06d2
SHA256825f6e9f5e39ba1faf76189ea2ec26135ac678706a3021156841cf4c086caeb7
SHA512085844b7dc63f46005be286ca512e99e03496eb5126d832b426bf7cb08e4530b201a3b5efdfcf8306d3602bcac19068745ed3d7f43b2dc4b0d495056c78bd9a4
-
Filesize
72KB
MD54d6a79c5e03428d0bc65eb2e2f1a3f75
SHA1428327fb1624cbd4310e69d07d3f3b5999fe1bea
SHA256ae5cf0475b5a8ec2ef97307d03f87d3fcf7732734c13b4b1eb600fc3d0d5c55d
SHA512f04d909a5a4a383baf68e8b2fb31bf82d58a525bfeeae587ad05f634e7e782a01bb9e094104987af3737df05e9f147b9d8025df3c57f6ad63554ba075d5b51fa
-
Filesize
72KB
MD5b7142fe2d26b4b88caa27eb984b2d4eb
SHA1104cae5f1fd5dedab17dbe6b09f3ffb3ab549db0
SHA2568917d72a41d57047c91e1c1b87daf7c2a62955cda35883f41e1623eff65d37d8
SHA512729ddb464d476365ac970509f52157ba4d150671162d2f7738c5e6c853ccb1a5245574abc9f1f8ac475bd0b7643d76d08f3f804b8b08f3ab2d1d17e317f92201
-
Filesize
72KB
MD5b7142fe2d26b4b88caa27eb984b2d4eb
SHA1104cae5f1fd5dedab17dbe6b09f3ffb3ab549db0
SHA2568917d72a41d57047c91e1c1b87daf7c2a62955cda35883f41e1623eff65d37d8
SHA512729ddb464d476365ac970509f52157ba4d150671162d2f7738c5e6c853ccb1a5245574abc9f1f8ac475bd0b7643d76d08f3f804b8b08f3ab2d1d17e317f92201
-
Filesize
72KB
MD532350becc952b3a9919a2550dcd91bf6
SHA19eeffe4bed46a7e12689c4952a8cc2e1caf72362
SHA256510e8c3dda959a4b20a6af0284cac0e2d894049e470a0b7da66930001bf742fa
SHA512cc0366306b3427f726db97510fae060a7f5f480c2c6aedfb6621c19770daf76dbde66ad535c66caf0c32994bc3929af20348761574aab5c43a3b8d4608dae04c
-
Filesize
72KB
MD532350becc952b3a9919a2550dcd91bf6
SHA19eeffe4bed46a7e12689c4952a8cc2e1caf72362
SHA256510e8c3dda959a4b20a6af0284cac0e2d894049e470a0b7da66930001bf742fa
SHA512cc0366306b3427f726db97510fae060a7f5f480c2c6aedfb6621c19770daf76dbde66ad535c66caf0c32994bc3929af20348761574aab5c43a3b8d4608dae04c
-
Filesize
72KB
MD5cd0debb6656a422bad56b230e9f0fa3a
SHA1c318460efeea117a6f385e68a2d3acfb07265cb7
SHA256318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46
SHA512a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f
-
Filesize
72KB
MD5cd0debb6656a422bad56b230e9f0fa3a
SHA1c318460efeea117a6f385e68a2d3acfb07265cb7
SHA256318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46
SHA512a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f
-
Filesize
72KB
MD564e7421265bea861b3d87f7549a17e73
SHA15dcd7665fceb4477d5e04a46cb775c17fa203ea1
SHA2560c91e30ab689c1d608983ba9d8f6de6884a3b6f82fc7f1c146417fcd71402215
SHA5123b52fc295f0734e589447f6c6ee6c1f9d1bc54e812ac32dcd5c18b95f852da8307600cef22bc91ed515a0b4a40b8ad213334e27af3fff46aa6472ab0a2c1da97
-
Filesize
72KB
MD564e7421265bea861b3d87f7549a17e73
SHA15dcd7665fceb4477d5e04a46cb775c17fa203ea1
SHA2560c91e30ab689c1d608983ba9d8f6de6884a3b6f82fc7f1c146417fcd71402215
SHA5123b52fc295f0734e589447f6c6ee6c1f9d1bc54e812ac32dcd5c18b95f852da8307600cef22bc91ed515a0b4a40b8ad213334e27af3fff46aa6472ab0a2c1da97
-
Filesize
72KB
MD5aa59de42bb02c54924b84a1ae56f8ead
SHA1801801c94bb6540f8ecb824be60e599d293fd9f0
SHA256aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721
SHA51288d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb
-
Filesize
72KB
MD5aa59de42bb02c54924b84a1ae56f8ead
SHA1801801c94bb6540f8ecb824be60e599d293fd9f0
SHA256aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721
SHA51288d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb
-
Filesize
72KB
MD5de7da1787c3f02b7d5b918595c803859
SHA1876cf63967a1ee8652b66c7b34aea39cd1be8947
SHA256aca5f4e65a8e4f2469102a14d5519e72d543c84b1d1f934b3698703192287e4d
SHA5121b5a2d56efe569e59839cd0a80075649745745abcfa6e8076b8301adfcc1b4b264ec0179d96f87fdabe0cb077ca25a3360d7ed4cb5fa7201da703ac249e90fa9
-
Filesize
72KB
MD5de7da1787c3f02b7d5b918595c803859
SHA1876cf63967a1ee8652b66c7b34aea39cd1be8947
SHA256aca5f4e65a8e4f2469102a14d5519e72d543c84b1d1f934b3698703192287e4d
SHA5121b5a2d56efe569e59839cd0a80075649745745abcfa6e8076b8301adfcc1b4b264ec0179d96f87fdabe0cb077ca25a3360d7ed4cb5fa7201da703ac249e90fa9
-
Filesize
72KB
MD5e38fc6d23fd2d40ac2d461b5c2c97a90
SHA108c39b905a27b3a6956039c35557fe86a96d5717
SHA256faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a
SHA51292175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696
-
Filesize
72KB
MD5e38fc6d23fd2d40ac2d461b5c2c97a90
SHA108c39b905a27b3a6956039c35557fe86a96d5717
SHA256faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a
SHA51292175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD5645e16c21e6755d996b100996cab30ee
SHA1f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9
SHA256414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582
SHA51278503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469
-
Filesize
72KB
MD50d12972d15db80dcfc525cf3f218fe47
SHA14d629606be8d7811d1b72639cae1dc31b0629577
SHA2569946cd1aa501ed442b19dc292e632cb6771742d5c977a19ee3aebea4e803ea1a
SHA5123d15ee11de42176b44d4535914f042aa7abd59283d7858bccc27693df4a1c42022aec3c3013cbe3329993d86590a5d53e2f8a0ee9890264d4f04ef3712fc187c
-
Filesize
72KB
MD50d12972d15db80dcfc525cf3f218fe47
SHA14d629606be8d7811d1b72639cae1dc31b0629577
SHA2569946cd1aa501ed442b19dc292e632cb6771742d5c977a19ee3aebea4e803ea1a
SHA5123d15ee11de42176b44d4535914f042aa7abd59283d7858bccc27693df4a1c42022aec3c3013cbe3329993d86590a5d53e2f8a0ee9890264d4f04ef3712fc187c
-
Filesize
72KB
MD5f65c69e2d2095dcfb78080d0bfd92e2b
SHA1e556195e1a420b9d1dc86506f8a5080c906407de
SHA2568b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558
SHA512fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32
-
Filesize
72KB
MD5f65c69e2d2095dcfb78080d0bfd92e2b
SHA1e556195e1a420b9d1dc86506f8a5080c906407de
SHA2568b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558
SHA512fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32
-
Filesize
72KB
MD5bcf7ebd80ba544925ab058160f276ed8
SHA1d79e5ebee9f54d4d47f42e78232729416cf64338
SHA256a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9
SHA512b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5
-
Filesize
72KB
MD5bcf7ebd80ba544925ab058160f276ed8
SHA1d79e5ebee9f54d4d47f42e78232729416cf64338
SHA256a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9
SHA512b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5
-
Filesize
72KB
MD5bbf7c143fba23a6ecc6af279eb42d707
SHA164ee2b5d56d14dfd127f60f7191e92b48032bd01
SHA2563f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510
SHA512efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903
-
Filesize
72KB
MD5bbf7c143fba23a6ecc6af279eb42d707
SHA164ee2b5d56d14dfd127f60f7191e92b48032bd01
SHA2563f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510
SHA512efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903
-
Filesize
72KB
MD58c8edfe082247d1025585dd714cdc0e5
SHA101e59bab2877b687581bc8c46a803500400af220
SHA256e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09
SHA5129e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6
-
Filesize
72KB
MD58c8edfe082247d1025585dd714cdc0e5
SHA101e59bab2877b687581bc8c46a803500400af220
SHA256e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09
SHA5129e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6
-
Filesize
72KB
MD58f042508fe60117e425c69088be0a357
SHA129c9bf4df911e8011a4abaa09c3d1d5c2115f3dd
SHA2562722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77
SHA512e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da
-
Filesize
72KB
MD58f042508fe60117e425c69088be0a357
SHA129c9bf4df911e8011a4abaa09c3d1d5c2115f3dd
SHA2562722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77
SHA512e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58f042508fe60117e425c69088be0a357
SHA129c9bf4df911e8011a4abaa09c3d1d5c2115f3dd
SHA2562722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77
SHA512e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58f042508fe60117e425c69088be0a357
SHA129c9bf4df911e8011a4abaa09c3d1d5c2115f3dd
SHA2562722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77
SHA512e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5e6492ee8990f05bacfd1a80c2be42bcc
SHA178bb078dac21435ccaaa0712bddf0202aabe06d2
SHA256825f6e9f5e39ba1faf76189ea2ec26135ac678706a3021156841cf4c086caeb7
SHA512085844b7dc63f46005be286ca512e99e03496eb5126d832b426bf7cb08e4530b201a3b5efdfcf8306d3602bcac19068745ed3d7f43b2dc4b0d495056c78bd9a4
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5e6492ee8990f05bacfd1a80c2be42bcc
SHA178bb078dac21435ccaaa0712bddf0202aabe06d2
SHA256825f6e9f5e39ba1faf76189ea2ec26135ac678706a3021156841cf4c086caeb7
SHA512085844b7dc63f46005be286ca512e99e03496eb5126d832b426bf7cb08e4530b201a3b5efdfcf8306d3602bcac19068745ed3d7f43b2dc4b0d495056c78bd9a4
-
Filesize
72KB
MD54d6a79c5e03428d0bc65eb2e2f1a3f75
SHA1428327fb1624cbd4310e69d07d3f3b5999fe1bea
SHA256ae5cf0475b5a8ec2ef97307d03f87d3fcf7732734c13b4b1eb600fc3d0d5c55d
SHA512f04d909a5a4a383baf68e8b2fb31bf82d58a525bfeeae587ad05f634e7e782a01bb9e094104987af3737df05e9f147b9d8025df3c57f6ad63554ba075d5b51fa
-
Filesize
72KB
MD54d6a79c5e03428d0bc65eb2e2f1a3f75
SHA1428327fb1624cbd4310e69d07d3f3b5999fe1bea
SHA256ae5cf0475b5a8ec2ef97307d03f87d3fcf7732734c13b4b1eb600fc3d0d5c55d
SHA512f04d909a5a4a383baf68e8b2fb31bf82d58a525bfeeae587ad05f634e7e782a01bb9e094104987af3737df05e9f147b9d8025df3c57f6ad63554ba075d5b51fa
-
Filesize
72KB
MD5d99c0e11ef35b5e14105089ce2df50f3
SHA141659446ff94b9bed5e0baaf8ab11389fcb6f34b
SHA256a0523740306ab01d55e149aa7693c3ff6ace69449cc447436dce5000770a674b
SHA5120a26e8bd28a45a9d48a74b3fb3e9a2653c3166a3571f29b030f98de92f578fcf833c323671d04f228a6f858b0182790a9179f89dd90e41732faa5c454bfd7862