Analysis
-
max time kernel
148s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe
Resource
win10v2004-20220812-en
General
-
Target
bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe
-
Size
72KB
-
MD5
0fea0bbb1ea050b843d9c47ecf6c90f0
-
SHA1
97dad33402ade98f52cf8fac1d2834e63afcd5f7
-
SHA256
bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0
-
SHA512
d1fe4db5c4c47312035fd8d59b4eaa2f1027c31635ad2e3e54027932098eff646d8bf9c9b11b2d3b0b04358d5d31a96262b82665544f0cc9363e8cabcc1068cd
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2B:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPV
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2020 backup.exe 1240 backup.exe 1312 backup.exe 972 backup.exe 904 backup.exe 1172 backup.exe 848 backup.exe 980 backup.exe 1168 backup.exe 1408 backup.exe 1996 backup.exe 676 data.exe 780 backup.exe 1648 backup.exe 240 data.exe 1916 backup.exe 1404 backup.exe 1548 backup.exe 1516 backup.exe 1424 backup.exe 1724 backup.exe 1624 backup.exe 1620 data.exe 556 backup.exe 1768 backup.exe 1500 backup.exe 1884 backup.exe 1716 backup.exe 1020 backup.exe 316 backup.exe 1904 backup.exe 1700 backup.exe 600 backup.exe 1200 backup.exe 284 backup.exe 1792 backup.exe 1932 backup.exe 1748 backup.exe 1964 backup.exe 844 update.exe 868 backup.exe 1916 update.exe 1288 backup.exe 1348 backup.exe 1756 backup.exe 1488 backup.exe 964 backup.exe 1760 backup.exe 1344 backup.exe 1984 backup.exe 1720 backup.exe 1620 backup.exe 556 data.exe 1768 data.exe 1500 data.exe 1884 backup.exe 1684 backup.exe 1044 backup.exe 980 System Restore.exe 784 System Restore.exe 544 backup.exe 832 backup.exe 1644 backup.exe 584 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 1172 backup.exe 1172 backup.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 848 backup.exe 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 848 backup.exe 1172 backup.exe 1172 backup.exe 1996 backup.exe 1996 backup.exe 676 data.exe 676 data.exe 1996 backup.exe 1996 backup.exe 1648 backup.exe 1648 backup.exe 240 data.exe 240 data.exe 240 data.exe 240 data.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1404 backup.exe 1172 backup.exe 1996 backup.exe 1172 backup.exe 1996 backup.exe 240 data.exe 1648 backup.exe 240 data.exe 1648 backup.exe 1404 backup.exe 1404 backup.exe 1648 backup.exe 1648 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe data.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe data.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe data.exe File opened for modification C:\Program Files\7-Zip\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe data.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 2020 backup.exe 1240 backup.exe 1312 backup.exe 972 backup.exe 904 backup.exe 1172 backup.exe 848 backup.exe 980 backup.exe 1168 backup.exe 1408 backup.exe 1996 backup.exe 676 data.exe 780 backup.exe 1648 backup.exe 240 data.exe 1916 backup.exe 1404 backup.exe 1548 backup.exe 1516 backup.exe 1424 backup.exe 1724 backup.exe 1624 backup.exe 1620 data.exe 556 backup.exe 1768 backup.exe 1500 backup.exe 1884 backup.exe 1716 backup.exe 1020 backup.exe 316 backup.exe 1904 backup.exe 1700 backup.exe 600 backup.exe 1200 backup.exe 1792 backup.exe 284 backup.exe 1932 backup.exe 1748 backup.exe 1964 backup.exe 868 backup.exe 1288 backup.exe 1348 backup.exe 1756 backup.exe 1488 backup.exe 1760 backup.exe 964 backup.exe 1344 backup.exe 1984 backup.exe 1720 backup.exe 1620 backup.exe 556 data.exe 1768 data.exe 1500 data.exe 1884 backup.exe 1684 backup.exe 1044 backup.exe 980 System Restore.exe 784 System Restore.exe 544 backup.exe 832 backup.exe 1644 backup.exe 584 backup.exe 1116 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 2020 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 27 PID 872 wrote to memory of 2020 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 27 PID 872 wrote to memory of 2020 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 27 PID 872 wrote to memory of 2020 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 27 PID 872 wrote to memory of 1240 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 28 PID 872 wrote to memory of 1240 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 28 PID 872 wrote to memory of 1240 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 28 PID 872 wrote to memory of 1240 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 28 PID 872 wrote to memory of 1312 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 29 PID 872 wrote to memory of 1312 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 29 PID 872 wrote to memory of 1312 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 29 PID 872 wrote to memory of 1312 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 29 PID 872 wrote to memory of 972 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 30 PID 872 wrote to memory of 972 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 30 PID 872 wrote to memory of 972 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 30 PID 872 wrote to memory of 972 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 30 PID 872 wrote to memory of 904 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 31 PID 872 wrote to memory of 904 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 31 PID 872 wrote to memory of 904 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 31 PID 872 wrote to memory of 904 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 31 PID 2020 wrote to memory of 1172 2020 backup.exe 32 PID 2020 wrote to memory of 1172 2020 backup.exe 32 PID 2020 wrote to memory of 1172 2020 backup.exe 32 PID 2020 wrote to memory of 1172 2020 backup.exe 32 PID 1172 wrote to memory of 848 1172 backup.exe 33 PID 1172 wrote to memory of 848 1172 backup.exe 33 PID 1172 wrote to memory of 848 1172 backup.exe 33 PID 1172 wrote to memory of 848 1172 backup.exe 33 PID 872 wrote to memory of 980 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 34 PID 872 wrote to memory of 980 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 34 PID 872 wrote to memory of 980 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 34 PID 872 wrote to memory of 980 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 34 PID 872 wrote to memory of 1168 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 35 PID 872 wrote to memory of 1168 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 35 PID 872 wrote to memory of 1168 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 35 PID 872 wrote to memory of 1168 872 bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe 35 PID 848 wrote to memory of 1408 848 backup.exe 36 PID 848 wrote to memory of 1408 848 backup.exe 36 PID 848 wrote to memory of 1408 848 backup.exe 36 PID 848 wrote to memory of 1408 848 backup.exe 36 PID 1172 wrote to memory of 1996 1172 backup.exe 37 PID 1172 wrote to memory of 1996 1172 backup.exe 37 PID 1172 wrote to memory of 1996 1172 backup.exe 37 PID 1172 wrote to memory of 1996 1172 backup.exe 37 PID 1996 wrote to memory of 676 1996 backup.exe 38 PID 1996 wrote to memory of 676 1996 backup.exe 38 PID 1996 wrote to memory of 676 1996 backup.exe 38 PID 1996 wrote to memory of 676 1996 backup.exe 38 PID 676 wrote to memory of 780 676 data.exe 39 PID 676 wrote to memory of 780 676 data.exe 39 PID 676 wrote to memory of 780 676 data.exe 39 PID 676 wrote to memory of 780 676 data.exe 39 PID 1996 wrote to memory of 1648 1996 backup.exe 40 PID 1996 wrote to memory of 1648 1996 backup.exe 40 PID 1996 wrote to memory of 1648 1996 backup.exe 40 PID 1996 wrote to memory of 1648 1996 backup.exe 40 PID 1648 wrote to memory of 240 1648 backup.exe 41 PID 1648 wrote to memory of 240 1648 backup.exe 41 PID 1648 wrote to memory of 240 1648 backup.exe 41 PID 1648 wrote to memory of 240 1648 backup.exe 41 PID 240 wrote to memory of 1916 240 data.exe 42 PID 240 wrote to memory of 1916 240 data.exe 42 PID 240 wrote to memory of 1916 240 data.exe 42 PID 240 wrote to memory of 1916 240 data.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe"C:\Users\Admin\AppData\Local\Temp\bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2159469762\backup.exeC:\Users\Admin\AppData\Local\Temp\2159469762\backup.exe C:\Users\Admin\AppData\Local\Temp\2159469762\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2020 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:848 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1408
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files\7-Zip\data.exe"C:\Program Files\7-Zip\data.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:780
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1648 -
C:\Program Files\Common Files\Microsoft Shared\data.exe"C:\Program Files\Common Files\Microsoft Shared\data.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1404 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1424
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1500
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:284 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1916
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
PID:1292
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵PID:1144
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵PID:1076
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵PID:1716
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- System policy modification
PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- System policy modification
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:1816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:784
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:316 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1200
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:868
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1756
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:544
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1340 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:364
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1076
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- System policy modification
PID:1732
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:600
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1564
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:1292
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:524
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1832
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1508
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1732
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:600 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1348 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\Common Files\System\ado\en-US\data.exe"C:\Program Files\Common Files\System\ado\en-US\data.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1500
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1684
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1828
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1396
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:904
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1440
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:848
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1500
-
-
C:\Program Files\Common Files\System\it-IT\update.exe"C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1172
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1716 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1488
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1344
-
-
C:\Program Files\DVD Maker\ja-JP\data.exe"C:\Program Files\DVD Maker\ja-JP\data.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1908 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1548
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1180
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:752
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1396
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:844
-
-
-
-
-
C:\Program Files\Google\System Restore.exe"C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Suspicious use of SetWindowsHookEx
PID:1116 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:696 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1740 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
PID:1176
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵
- System policy modification
PID:1536
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:868
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1876 -
C:\Program Files\Internet Explorer\de-DE\update.exe"C:\Program Files\Internet Explorer\de-DE\update.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1176
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1916
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1632
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1696
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1640
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:568
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:864
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1020 -
C:\Program Files (x86)\Adobe\update.exe"C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
PID:844 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:580 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵PID:572
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵PID:1440
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:2220
-
-
-
-
C:\Program Files (x86)\Common Files\update.exe"C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:268 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- System policy modification
PID:692 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:756
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1216
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:2228
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1364
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:696
-
-
-
C:\Program Files (x86)\Google\update.exe"C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\5⤵PID:632
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft Analysis Services\update.exe"C:\Program Files (x86)\Microsoft Analysis Services\update.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1036
-
-
-
C:\Users\System Restore.exe"C:\Users\System Restore.exe" C:\Users\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644 -
C:\Users\Admin\Contacts\System Restore.exe"C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
PID:640
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1640
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- System policy modification
PID:1712
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1384
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1588
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:1360
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1620 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1572
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:576
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:832
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:1660
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵PID:2236
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
PID:1772 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:640
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:2004
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1712
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1532
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1168
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD504125e103cdeb1655cd3b4de220cdcd4
SHA1216ab69a9cf7fc4870a45d5d998bfee09491825e
SHA256f7bb5bf89c719e289e1019b8d666f46244f7e491476b093f4d2f2c4c485706f7
SHA5120bcf228341cf0bf7f44c1a37b83f00e0eb423842e5a5108cec8e4c71b0fd1c0b55cda847f7d1c77fb9d38faa944725c367da64e82ac4c853eb6469e8e8482052
-
Filesize
72KB
MD5fd73ba287104833ea9761bb3ccc19405
SHA1404637bab6fec42bae9b7ca80b7fb0c01e956389
SHA2563aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18
SHA512d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429
-
Filesize
72KB
MD5fd73ba287104833ea9761bb3ccc19405
SHA1404637bab6fec42bae9b7ca80b7fb0c01e956389
SHA2563aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18
SHA512d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429
-
Filesize
72KB
MD59ae4b35fa8fb81db6b2f4016ebc7aa79
SHA1f81b6ab30e6c050e7f9a389b4979a121d7e3a6b1
SHA25691759a07bdb76161ce6684142441781361f31706feb2b6c645306827077512af
SHA51258353681fdfba763b76f256c725eb790828506d7672db3803c178a79d59bd30d34b9e952cee3ce07da7385d0ada9b47c2c7baf328f708075355ed436e223a745
-
Filesize
72KB
MD5a238d174496300aa32294dad02e323df
SHA111cf2aa734f836f112336c05addde0dd025d1693
SHA2566414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546
SHA5125341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97
-
Filesize
72KB
MD5a238d174496300aa32294dad02e323df
SHA111cf2aa734f836f112336c05addde0dd025d1693
SHA2566414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546
SHA5125341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD567a9abc36300024738728880db989fb6
SHA16a41add47326cda3846171dcbe64fd4f8afabe75
SHA2568499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004
SHA5128295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8
-
Filesize
72KB
MD567a9abc36300024738728880db989fb6
SHA16a41add47326cda3846171dcbe64fd4f8afabe75
SHA2568499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004
SHA5128295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD58e50a5807a353168309e1df2137bef26
SHA16da02d9f59208e3b4a9e1a3117c257e40361561a
SHA256b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37
SHA5124011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5
-
Filesize
72KB
MD58e50a5807a353168309e1df2137bef26
SHA16da02d9f59208e3b4a9e1a3117c257e40361561a
SHA256b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37
SHA5124011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5
-
Filesize
72KB
MD5f30c6697a9a9a51ae11d36028c737511
SHA180a7bd7f69a02808e5ebc2de692caafa9844f41d
SHA256f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978
SHA51262dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5
-
Filesize
72KB
MD5f30c6697a9a9a51ae11d36028c737511
SHA180a7bd7f69a02808e5ebc2de692caafa9844f41d
SHA256f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978
SHA51262dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f98306732322b080150775d29ecd9b8e
SHA1286630324b5d674fd769d166a1dbe6617ee8a1bd
SHA2568735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236
SHA5121535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f98306732322b080150775d29ecd9b8e
SHA1286630324b5d674fd769d166a1dbe6617ee8a1bd
SHA2568735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236
SHA5121535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd
-
Filesize
72KB
MD5640b7d6d18a7262e974ab0f64f221026
SHA149be78a53617b1f50ec83fc343567e6c50f3b0f1
SHA25633d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648
SHA5121a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5378547eb659d946e749cd59c15eaab5d
SHA1c20291ffbd1008429dc25f8123a4b6087501e2bb
SHA256712fb78bcad9d15df2d80b4871c60a685ac03cdffc89244d225418c87087503b
SHA512c3a0108a1ae8dd25e3ddb599ac5edf08d203cb3bf142213b678efe933da14a7a8f83fcc76ab295bfc8710c3b1d7ee29bc813c367c25eb8191a543a29d4c082c5
-
Filesize
72KB
MD55e9ce3009aa95820004c63102a148878
SHA18287ac18d336907f6c817a9756f4ddde4b3ac47f
SHA2560c4c1efb179b1249450eee602fa6569a871a519b2955c5923e4c5f64964d8bd8
SHA5120f12bf5faafd09d8aff1af30f7af123d4bc39c76d72553f342082299cd67ab6c0833177ab0df559bca013cdce7ef8f7a78390d465d283646c0907936370e4e9f
-
Filesize
72KB
MD55e9ce3009aa95820004c63102a148878
SHA18287ac18d336907f6c817a9756f4ddde4b3ac47f
SHA2560c4c1efb179b1249450eee602fa6569a871a519b2955c5923e4c5f64964d8bd8
SHA5120f12bf5faafd09d8aff1af30f7af123d4bc39c76d72553f342082299cd67ab6c0833177ab0df559bca013cdce7ef8f7a78390d465d283646c0907936370e4e9f
-
Filesize
72KB
MD504125e103cdeb1655cd3b4de220cdcd4
SHA1216ab69a9cf7fc4870a45d5d998bfee09491825e
SHA256f7bb5bf89c719e289e1019b8d666f46244f7e491476b093f4d2f2c4c485706f7
SHA5120bcf228341cf0bf7f44c1a37b83f00e0eb423842e5a5108cec8e4c71b0fd1c0b55cda847f7d1c77fb9d38faa944725c367da64e82ac4c853eb6469e8e8482052
-
Filesize
72KB
MD504125e103cdeb1655cd3b4de220cdcd4
SHA1216ab69a9cf7fc4870a45d5d998bfee09491825e
SHA256f7bb5bf89c719e289e1019b8d666f46244f7e491476b093f4d2f2c4c485706f7
SHA5120bcf228341cf0bf7f44c1a37b83f00e0eb423842e5a5108cec8e4c71b0fd1c0b55cda847f7d1c77fb9d38faa944725c367da64e82ac4c853eb6469e8e8482052
-
Filesize
72KB
MD5fd73ba287104833ea9761bb3ccc19405
SHA1404637bab6fec42bae9b7ca80b7fb0c01e956389
SHA2563aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18
SHA512d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429
-
Filesize
72KB
MD5fd73ba287104833ea9761bb3ccc19405
SHA1404637bab6fec42bae9b7ca80b7fb0c01e956389
SHA2563aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18
SHA512d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429
-
Filesize
72KB
MD59ae4b35fa8fb81db6b2f4016ebc7aa79
SHA1f81b6ab30e6c050e7f9a389b4979a121d7e3a6b1
SHA25691759a07bdb76161ce6684142441781361f31706feb2b6c645306827077512af
SHA51258353681fdfba763b76f256c725eb790828506d7672db3803c178a79d59bd30d34b9e952cee3ce07da7385d0ada9b47c2c7baf328f708075355ed436e223a745
-
Filesize
72KB
MD59ae4b35fa8fb81db6b2f4016ebc7aa79
SHA1f81b6ab30e6c050e7f9a389b4979a121d7e3a6b1
SHA25691759a07bdb76161ce6684142441781361f31706feb2b6c645306827077512af
SHA51258353681fdfba763b76f256c725eb790828506d7672db3803c178a79d59bd30d34b9e952cee3ce07da7385d0ada9b47c2c7baf328f708075355ed436e223a745
-
Filesize
72KB
MD5a238d174496300aa32294dad02e323df
SHA111cf2aa734f836f112336c05addde0dd025d1693
SHA2566414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546
SHA5125341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97
-
Filesize
72KB
MD5a238d174496300aa32294dad02e323df
SHA111cf2aa734f836f112336c05addde0dd025d1693
SHA2566414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546
SHA5125341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD567a9abc36300024738728880db989fb6
SHA16a41add47326cda3846171dcbe64fd4f8afabe75
SHA2568499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004
SHA5128295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8
-
Filesize
72KB
MD567a9abc36300024738728880db989fb6
SHA16a41add47326cda3846171dcbe64fd4f8afabe75
SHA2568499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004
SHA5128295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD5c943bff8618b95d51c64c6e31c03a1a1
SHA1e1ef436a4c868b6de4e13a2f23aeabaf30ea7934
SHA256e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29
SHA51223e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD56cd1d951819319391d9844ee92818002
SHA1a09bb703b138897cc39636152349420e152622ca
SHA256c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2
SHA51212ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839
-
Filesize
72KB
MD58e50a5807a353168309e1df2137bef26
SHA16da02d9f59208e3b4a9e1a3117c257e40361561a
SHA256b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37
SHA5124011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5
-
Filesize
72KB
MD58e50a5807a353168309e1df2137bef26
SHA16da02d9f59208e3b4a9e1a3117c257e40361561a
SHA256b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37
SHA5124011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5
-
Filesize
72KB
MD5f30c6697a9a9a51ae11d36028c737511
SHA180a7bd7f69a02808e5ebc2de692caafa9844f41d
SHA256f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978
SHA51262dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5
-
Filesize
72KB
MD5f30c6697a9a9a51ae11d36028c737511
SHA180a7bd7f69a02808e5ebc2de692caafa9844f41d
SHA256f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978
SHA51262dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f98306732322b080150775d29ecd9b8e
SHA1286630324b5d674fd769d166a1dbe6617ee8a1bd
SHA2568735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236
SHA5121535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f98306732322b080150775d29ecd9b8e
SHA1286630324b5d674fd769d166a1dbe6617ee8a1bd
SHA2568735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236
SHA5121535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f98306732322b080150775d29ecd9b8e
SHA1286630324b5d674fd769d166a1dbe6617ee8a1bd
SHA2568735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236
SHA5121535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f98306732322b080150775d29ecd9b8e
SHA1286630324b5d674fd769d166a1dbe6617ee8a1bd
SHA2568735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236
SHA5121535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd
-
Filesize
72KB
MD5640b7d6d18a7262e974ab0f64f221026
SHA149be78a53617b1f50ec83fc343567e6c50f3b0f1
SHA25633d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648
SHA5121a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05
-
Filesize
72KB
MD5640b7d6d18a7262e974ab0f64f221026
SHA149be78a53617b1f50ec83fc343567e6c50f3b0f1
SHA25633d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648
SHA5121a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5778644173f1c62eee30660bde8d79534
SHA12c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c
SHA25684ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7
SHA512f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db
-
Filesize
72KB
MD5378547eb659d946e749cd59c15eaab5d
SHA1c20291ffbd1008429dc25f8123a4b6087501e2bb
SHA256712fb78bcad9d15df2d80b4871c60a685ac03cdffc89244d225418c87087503b
SHA512c3a0108a1ae8dd25e3ddb599ac5edf08d203cb3bf142213b678efe933da14a7a8f83fcc76ab295bfc8710c3b1d7ee29bc813c367c25eb8191a543a29d4c082c5
-
Filesize
72KB
MD5378547eb659d946e749cd59c15eaab5d
SHA1c20291ffbd1008429dc25f8123a4b6087501e2bb
SHA256712fb78bcad9d15df2d80b4871c60a685ac03cdffc89244d225418c87087503b
SHA512c3a0108a1ae8dd25e3ddb599ac5edf08d203cb3bf142213b678efe933da14a7a8f83fcc76ab295bfc8710c3b1d7ee29bc813c367c25eb8191a543a29d4c082c5