Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe
Resource
win10v2004-20220812-en
General
-
Target
501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe
-
Size
72KB
-
MD5
0e468934202c06e9c435b7971605babe
-
SHA1
8f906b324fa119331fa72c0166556d9bfd05e4e4
-
SHA256
501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39
-
SHA512
e6cd8f18e6b51cfe9426aaa72c966bec3d364e715259498e282f56fd2de4063bc97541b039ad47f81c3d7fd3ff48505c65a33fb0eea2d45d9d6c9e122383c67d
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2c:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1444 backup.exe 1220 backup.exe 1240 backup.exe 288 System Restore.exe 1824 backup.exe 664 backup.exe 1012 backup.exe 1708 backup.exe 1664 backup.exe 1940 backup.exe 832 backup.exe 1728 backup.exe 1524 backup.exe 1608 backup.exe 1980 backup.exe 928 backup.exe 1016 backup.exe 1108 backup.exe 1224 backup.exe 1836 data.exe 972 backup.exe 876 update.exe 1164 System Restore.exe 628 backup.exe 900 backup.exe 820 backup.exe 1480 backup.exe 1804 backup.exe 844 backup.exe 760 backup.exe 828 backup.exe 1528 backup.exe 1692 backup.exe 108 backup.exe 1348 backup.exe 1524 backup.exe 1060 backup.exe 1420 backup.exe 1496 backup.exe 1892 backup.exe 928 backup.exe 2040 backup.exe 1368 backup.exe 1840 backup.exe 1812 backup.exe 1224 backup.exe 1800 backup.exe 580 backup.exe 576 backup.exe 876 backup.exe 628 backup.exe 1112 backup.exe 1020 backup.exe 676 backup.exe 1956 backup.exe 1560 backup.exe 1480 backup.exe 1664 backup.exe 1584 backup.exe 2012 backup.exe 1732 backup.exe 1772 backup.exe 1692 backup.exe 840 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1708 backup.exe 1708 backup.exe 1664 backup.exe 1664 backup.exe 1708 backup.exe 1708 backup.exe 832 backup.exe 832 backup.exe 1728 backup.exe 1728 backup.exe 832 backup.exe 832 backup.exe 1608 backup.exe 1608 backup.exe 1980 backup.exe 1980 backup.exe 1980 backup.exe 1980 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 876 update.exe 876 update.exe 876 update.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1016 backup.exe 1708 backup.exe 1708 backup.exe 1980 backup.exe 1016 backup.exe 1016 backup.exe 1980 backup.exe 832 backup.exe 832 backup.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 760 backup.exe 1804 backup.exe 760 backup.exe 1804 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\update.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\System Restore.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 1444 backup.exe 1220 backup.exe 1240 backup.exe 288 System Restore.exe 1824 backup.exe 664 backup.exe 1012 backup.exe 1708 backup.exe 1664 backup.exe 1940 backup.exe 832 backup.exe 1728 backup.exe 1524 backup.exe 1608 backup.exe 1980 backup.exe 928 backup.exe 1016 backup.exe 1108 backup.exe 1224 backup.exe 1836 data.exe 972 backup.exe 876 update.exe 1164 System Restore.exe 628 backup.exe 900 backup.exe 820 backup.exe 1480 backup.exe 1804 backup.exe 844 backup.exe 760 backup.exe 1528 backup.exe 828 backup.exe 1692 backup.exe 108 backup.exe 1348 backup.exe 1060 backup.exe 1496 backup.exe 1524 backup.exe 1420 backup.exe 1892 backup.exe 2040 backup.exe 928 backup.exe 1840 backup.exe 1812 backup.exe 1224 backup.exe 1368 backup.exe 580 backup.exe 1800 backup.exe 576 backup.exe 876 backup.exe 1112 backup.exe 628 backup.exe 676 backup.exe 1020 backup.exe 1956 backup.exe 1480 backup.exe 1560 backup.exe 1664 backup.exe 2012 backup.exe 1692 backup.exe 1584 backup.exe 1772 backup.exe 1732 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1444 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 27 PID 1632 wrote to memory of 1444 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 27 PID 1632 wrote to memory of 1444 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 27 PID 1632 wrote to memory of 1444 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 27 PID 1632 wrote to memory of 1220 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 28 PID 1632 wrote to memory of 1220 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 28 PID 1632 wrote to memory of 1220 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 28 PID 1632 wrote to memory of 1220 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 28 PID 1632 wrote to memory of 1240 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 29 PID 1632 wrote to memory of 1240 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 29 PID 1632 wrote to memory of 1240 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 29 PID 1632 wrote to memory of 1240 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 29 PID 1632 wrote to memory of 288 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 30 PID 1632 wrote to memory of 288 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 30 PID 1632 wrote to memory of 288 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 30 PID 1632 wrote to memory of 288 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 30 PID 1632 wrote to memory of 1824 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 31 PID 1632 wrote to memory of 1824 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 31 PID 1632 wrote to memory of 1824 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 31 PID 1632 wrote to memory of 1824 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 31 PID 1632 wrote to memory of 664 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 32 PID 1632 wrote to memory of 664 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 32 PID 1632 wrote to memory of 664 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 32 PID 1632 wrote to memory of 664 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 32 PID 1632 wrote to memory of 1012 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 33 PID 1632 wrote to memory of 1012 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 33 PID 1632 wrote to memory of 1012 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 33 PID 1632 wrote to memory of 1012 1632 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe 33 PID 1444 wrote to memory of 1708 1444 backup.exe 34 PID 1444 wrote to memory of 1708 1444 backup.exe 34 PID 1444 wrote to memory of 1708 1444 backup.exe 34 PID 1444 wrote to memory of 1708 1444 backup.exe 34 PID 1708 wrote to memory of 1664 1708 backup.exe 35 PID 1708 wrote to memory of 1664 1708 backup.exe 35 PID 1708 wrote to memory of 1664 1708 backup.exe 35 PID 1708 wrote to memory of 1664 1708 backup.exe 35 PID 1664 wrote to memory of 1940 1664 backup.exe 36 PID 1664 wrote to memory of 1940 1664 backup.exe 36 PID 1664 wrote to memory of 1940 1664 backup.exe 36 PID 1664 wrote to memory of 1940 1664 backup.exe 36 PID 1708 wrote to memory of 832 1708 backup.exe 37 PID 1708 wrote to memory of 832 1708 backup.exe 37 PID 1708 wrote to memory of 832 1708 backup.exe 37 PID 1708 wrote to memory of 832 1708 backup.exe 37 PID 832 wrote to memory of 1728 832 backup.exe 38 PID 832 wrote to memory of 1728 832 backup.exe 38 PID 832 wrote to memory of 1728 832 backup.exe 38 PID 832 wrote to memory of 1728 832 backup.exe 38 PID 1728 wrote to memory of 1524 1728 backup.exe 39 PID 1728 wrote to memory of 1524 1728 backup.exe 39 PID 1728 wrote to memory of 1524 1728 backup.exe 39 PID 1728 wrote to memory of 1524 1728 backup.exe 39 PID 832 wrote to memory of 1608 832 backup.exe 40 PID 832 wrote to memory of 1608 832 backup.exe 40 PID 832 wrote to memory of 1608 832 backup.exe 40 PID 832 wrote to memory of 1608 832 backup.exe 40 PID 1608 wrote to memory of 1980 1608 backup.exe 41 PID 1608 wrote to memory of 1980 1608 backup.exe 41 PID 1608 wrote to memory of 1980 1608 backup.exe 41 PID 1608 wrote to memory of 1980 1608 backup.exe 41 PID 1980 wrote to memory of 928 1980 backup.exe 42 PID 1980 wrote to memory of 928 1980 backup.exe 42 PID 1980 wrote to memory of 928 1980 backup.exe 42 PID 1980 wrote to memory of 928 1980 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe"C:\Users\Admin\AppData\Local\Temp\501824f2ac8afbb811cf206f4be7e619ddd81a03e18cf327a21b70316dff8d39.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3397033143\backup.exeC:\Users\Admin\AppData\Local\Temp\3397033143\backup.exe C:\Users\Admin\AppData\Local\Temp\3397033143\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1444 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1708 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1664 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1940
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1728 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1608 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1980 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1016 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:876
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:108
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:576 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1232
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1284
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
PID:1852
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:1540
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:820
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1620
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:820 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1368
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:876
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1020
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1772
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1364 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:556
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:664
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:876
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1436
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:836
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:760 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:828
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1420 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:580
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:676
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1664
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:840
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1340
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1160
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
PID:1612
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:676
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1572
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:992
-
-
C:\Program Files\Common Files\System\ja-JP\data.exe"C:\Program Files\Common Files\System\ja-JP\data.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1964
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1732
-
-
C:\Program Files\Common Files\System\Ole DB\data.exe"C:\Program Files\Common Files\System\Ole DB\data.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1840
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1804 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1060
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2040
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1224
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:628
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1584
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
PID:1052 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1824 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:616
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1104
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:844
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:828
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:752
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:2036
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:1844
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1428
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1644
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1748 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1812
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1968
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:2044
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1688
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1324
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1160
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1740
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1056
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:900 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1348 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1524 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1840
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1800 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1560
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1732
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1952 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Disables RegEdit via registry modification
PID:952
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:280
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1652 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:600
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:908
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1332
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:2008
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:952
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:904
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:948
-
-
-
-
C:\Program Files (x86)\Common Files\System Restore.exe"C:\Program Files (x86)\Common Files\System Restore.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1480 -
C:\Program Files (x86)\Common Files\Adobe\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1172
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1128
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:972
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1368
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
PID:1940 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1060
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1012
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1220
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:288
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:664
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1012
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c5fa5dc1369f978a45e5fc441734b488
SHA192f7cc1229636e66c800e768476290c3697a5d9f
SHA256f51e23e7466f7cc91b2db0af3758224dfb94793d4a2bc2062501914f642edf84
SHA5120ea6ebb9bf42715f4adc4212d5a977c29e0d3189fe7417f344ced8a917b9f0b164c2e1c70b125b5d2f4c68f9c077de56def8a748659b001e68e01e4ec854c90f
-
Filesize
72KB
MD5c5ac4066690b786b01ddb90fa082b717
SHA1f806d807e4207d59af120c2f2aa5f35cdeea1c0b
SHA256ceea2753918a151c41e5615a59bc92c49c16d3940a854f0ef46660b49fb708cc
SHA5122f8a0b287803e7feb449c595033bba657e5482dbcbd8da5cb7ba59a836b8d80788c14e9bfa4f3a659b9082c834cd3ed432fc574ed0df1eb2abee6dd1f304d8f5
-
Filesize
72KB
MD5c5ac4066690b786b01ddb90fa082b717
SHA1f806d807e4207d59af120c2f2aa5f35cdeea1c0b
SHA256ceea2753918a151c41e5615a59bc92c49c16d3940a854f0ef46660b49fb708cc
SHA5122f8a0b287803e7feb449c595033bba657e5482dbcbd8da5cb7ba59a836b8d80788c14e9bfa4f3a659b9082c834cd3ed432fc574ed0df1eb2abee6dd1f304d8f5
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5b9faf61222cb76dab9c9cce1892a2584
SHA11dddd5387526e1987550e58b05de0fc4dc16c848
SHA256242293c11dfbe456fccd2e940c8e2acfd49bdd6f0669eb78bc31d2c93769e353
SHA5128d7bd299874cefdc6e02bfaf70792c5237b2370d7f532c72fdedc30851c990e40d455b6ec176a4647441fedb43e72cd3c3a4777201970c78ee82794c75db7f47
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD514331c1a60cc3c6b5b7917c44b54b77e
SHA1bc2fef6b74f663ad5b58ec92db2456cb8348ddb9
SHA2561a2458d94a81d5508d5a54826ad868a61a2f2b5948009e219b8389bfff12c902
SHA512500e1c9a3692c5c86f2b8bb8838bb6af24554e2af0e8575ac5dd110b4055742cbbd5ba0b5b933b5a31ef0057453f5bfe2e080fbae72581616417483f7deb9f0b
-
Filesize
72KB
MD514331c1a60cc3c6b5b7917c44b54b77e
SHA1bc2fef6b74f663ad5b58ec92db2456cb8348ddb9
SHA2561a2458d94a81d5508d5a54826ad868a61a2f2b5948009e219b8389bfff12c902
SHA512500e1c9a3692c5c86f2b8bb8838bb6af24554e2af0e8575ac5dd110b4055742cbbd5ba0b5b933b5a31ef0057453f5bfe2e080fbae72581616417483f7deb9f0b
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5871c56555bf2ead141e436e1be069559
SHA15d1ccafdab307ffeb2aedaa5df7bbbe308db0a0d
SHA25632c984db7e0ce8d94dad9d8c1f2852d6c9fab3fc322687a00ca040b7eccc9eeb
SHA512f6bfe62165c073995432284fef00c572b646d3cf6d9486b44f3d9d9b8cc3c8addaa3fcdcbf81246dd07f4b8e7a85d04739cd50b57845a6f505885a707d655813
-
Filesize
72KB
MD5871c56555bf2ead141e436e1be069559
SHA15d1ccafdab307ffeb2aedaa5df7bbbe308db0a0d
SHA25632c984db7e0ce8d94dad9d8c1f2852d6c9fab3fc322687a00ca040b7eccc9eeb
SHA512f6bfe62165c073995432284fef00c572b646d3cf6d9486b44f3d9d9b8cc3c8addaa3fcdcbf81246dd07f4b8e7a85d04739cd50b57845a6f505885a707d655813
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD529e53fefd186fe6c9d29f3eb8dc8d6a3
SHA1958520f0f0750344332c0c9f91ef27cd7818476d
SHA256bfc17d5ccdc139fc2c1c39074ff3c4aaee19af18b648fd0f67032a7c3c4a7bed
SHA5120f28b31d11f2a13d4964117dd476c55dae270e5402ed41b94b05f9220212eab3b813e99dc82c78f48fcccc5a1aac58a600dd37d1e58983fd2649252329cb9458
-
Filesize
72KB
MD529e53fefd186fe6c9d29f3eb8dc8d6a3
SHA1958520f0f0750344332c0c9f91ef27cd7818476d
SHA256bfc17d5ccdc139fc2c1c39074ff3c4aaee19af18b648fd0f67032a7c3c4a7bed
SHA5120f28b31d11f2a13d4964117dd476c55dae270e5402ed41b94b05f9220212eab3b813e99dc82c78f48fcccc5a1aac58a600dd37d1e58983fd2649252329cb9458
-
Filesize
72KB
MD5c5fa5dc1369f978a45e5fc441734b488
SHA192f7cc1229636e66c800e768476290c3697a5d9f
SHA256f51e23e7466f7cc91b2db0af3758224dfb94793d4a2bc2062501914f642edf84
SHA5120ea6ebb9bf42715f4adc4212d5a977c29e0d3189fe7417f344ced8a917b9f0b164c2e1c70b125b5d2f4c68f9c077de56def8a748659b001e68e01e4ec854c90f
-
Filesize
72KB
MD5c5fa5dc1369f978a45e5fc441734b488
SHA192f7cc1229636e66c800e768476290c3697a5d9f
SHA256f51e23e7466f7cc91b2db0af3758224dfb94793d4a2bc2062501914f642edf84
SHA5120ea6ebb9bf42715f4adc4212d5a977c29e0d3189fe7417f344ced8a917b9f0b164c2e1c70b125b5d2f4c68f9c077de56def8a748659b001e68e01e4ec854c90f
-
Filesize
72KB
MD5c5ac4066690b786b01ddb90fa082b717
SHA1f806d807e4207d59af120c2f2aa5f35cdeea1c0b
SHA256ceea2753918a151c41e5615a59bc92c49c16d3940a854f0ef46660b49fb708cc
SHA5122f8a0b287803e7feb449c595033bba657e5482dbcbd8da5cb7ba59a836b8d80788c14e9bfa4f3a659b9082c834cd3ed432fc574ed0df1eb2abee6dd1f304d8f5
-
Filesize
72KB
MD5c5ac4066690b786b01ddb90fa082b717
SHA1f806d807e4207d59af120c2f2aa5f35cdeea1c0b
SHA256ceea2753918a151c41e5615a59bc92c49c16d3940a854f0ef46660b49fb708cc
SHA5122f8a0b287803e7feb449c595033bba657e5482dbcbd8da5cb7ba59a836b8d80788c14e9bfa4f3a659b9082c834cd3ed432fc574ed0df1eb2abee6dd1f304d8f5
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5b9faf61222cb76dab9c9cce1892a2584
SHA11dddd5387526e1987550e58b05de0fc4dc16c848
SHA256242293c11dfbe456fccd2e940c8e2acfd49bdd6f0669eb78bc31d2c93769e353
SHA5128d7bd299874cefdc6e02bfaf70792c5237b2370d7f532c72fdedc30851c990e40d455b6ec176a4647441fedb43e72cd3c3a4777201970c78ee82794c75db7f47
-
Filesize
72KB
MD5b9faf61222cb76dab9c9cce1892a2584
SHA11dddd5387526e1987550e58b05de0fc4dc16c848
SHA256242293c11dfbe456fccd2e940c8e2acfd49bdd6f0669eb78bc31d2c93769e353
SHA5128d7bd299874cefdc6e02bfaf70792c5237b2370d7f532c72fdedc30851c990e40d455b6ec176a4647441fedb43e72cd3c3a4777201970c78ee82794c75db7f47
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5e206b04b55077fe251d2597be35be209
SHA1cdd935a74c095aac5d2d64b074ea82a91526397c
SHA2563153014f736fccf28575abd12d91e10a617bc2b06a1d1bf60ed500a3ebd19cce
SHA512a43b0e34b23904934a6012150c8ee99be7e4ef363140c288c2a94cc90f6ea38bc0f4844dd333e5755527d16ae231a5b2d3d9f20db54c04b55e8fee15d3faff9b
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD514331c1a60cc3c6b5b7917c44b54b77e
SHA1bc2fef6b74f663ad5b58ec92db2456cb8348ddb9
SHA2561a2458d94a81d5508d5a54826ad868a61a2f2b5948009e219b8389bfff12c902
SHA512500e1c9a3692c5c86f2b8bb8838bb6af24554e2af0e8575ac5dd110b4055742cbbd5ba0b5b933b5a31ef0057453f5bfe2e080fbae72581616417483f7deb9f0b
-
Filesize
72KB
MD514331c1a60cc3c6b5b7917c44b54b77e
SHA1bc2fef6b74f663ad5b58ec92db2456cb8348ddb9
SHA2561a2458d94a81d5508d5a54826ad868a61a2f2b5948009e219b8389bfff12c902
SHA512500e1c9a3692c5c86f2b8bb8838bb6af24554e2af0e8575ac5dd110b4055742cbbd5ba0b5b933b5a31ef0057453f5bfe2e080fbae72581616417483f7deb9f0b
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD5d4bdbcf969381f20cf845da539ec6de3
SHA13a7323fa63eaee68242ac29e5ae8b4f50c2b4635
SHA256b5be00c94a3f0d213e43f2419c66ae7cacba915cd969f13a86e5cc9af4913651
SHA5123b4fa9baeb974c9d72dd0bccc2e32dd8c69ea573fda3ec4995be9914a95fc5c8bf2535ae06fa1467c92f20e5e1794674c51a160ab31f754d849b225fa9d0912f
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5cbe7320cca7ffab3dfc5cfdcf869a180
SHA1ae12ac7804ee5ce8c8948efca7a535e98679d0b5
SHA256940da7515e1de27daba365d68297163ea6deeda3abfccbc62401af8778b863ae
SHA51241884f57eb8da3ac1f8fc43953b420ebd0034432eca6960fcac9bc89ec973a56d354c01e05c967410eec604ff985be2f0adb6d49ddaf49d441a5c2579aeb8bb3
-
Filesize
72KB
MD5871c56555bf2ead141e436e1be069559
SHA15d1ccafdab307ffeb2aedaa5df7bbbe308db0a0d
SHA25632c984db7e0ce8d94dad9d8c1f2852d6c9fab3fc322687a00ca040b7eccc9eeb
SHA512f6bfe62165c073995432284fef00c572b646d3cf6d9486b44f3d9d9b8cc3c8addaa3fcdcbf81246dd07f4b8e7a85d04739cd50b57845a6f505885a707d655813
-
Filesize
72KB
MD5871c56555bf2ead141e436e1be069559
SHA15d1ccafdab307ffeb2aedaa5df7bbbe308db0a0d
SHA25632c984db7e0ce8d94dad9d8c1f2852d6c9fab3fc322687a00ca040b7eccc9eeb
SHA512f6bfe62165c073995432284fef00c572b646d3cf6d9486b44f3d9d9b8cc3c8addaa3fcdcbf81246dd07f4b8e7a85d04739cd50b57845a6f505885a707d655813
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d8b172ec388a43df8b2df48e586b2c5e
SHA16e5aa76821f408e448b5e49ae38362ad0ca01fd2
SHA2565ca684ab2c2d685596401abd02a26574c374850515823079acd12eddda8684bf
SHA51219bd4ab539b41d27f30de0597930312724b2f2f0feb4d799b383fceb13322511fae29f6aa89f39ab3e4ae1609d3a4fa4ae0eca33d1755f46d756324250ba0d3c
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461
-
Filesize
72KB
MD5d6bab3a1b4d0834256129b8bc74e297e
SHA12579dcf7a3ff374ca1d7c44d58eb31c87f83a725
SHA256c6d613d137adb60f352d7112aadefca2e54205d942548196aeb58ef52d4404cb
SHA5127f6e5e4f58f2b759e4d2212fc9f11569b101fa40a830e6cc2474b56f8b6ffa0f103c615d1c0dc1f0a687d348d79126340dc091a99d19bc5ee31e53ccee189461