Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
Resource
win10v2004-20220812-en
General
-
Target
20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
-
Size
72KB
-
MD5
0d4b6365fc3e16318df9a711f51a0e9e
-
SHA1
f3bd1f90f2fceef697658f624c4a8213cd4ba2d2
-
SHA256
20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd
-
SHA512
0906a786e4ead16ca9e3d87be6a8684b64729a0e6d1c6d631f2808ece351bd708c1b9040ae1cb94eaf9872ccb92a9ad9330a7b6c3b8ac9e7573dd2e58bfe213b
-
SSDEEP
768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyvg:HeT7BVwxfvqguKRFAl
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 968 System Restore.exe 1404 backup.exe 1744 backup.exe 336 data.exe 1372 backup.exe 672 backup.exe 688 backup.exe 1064 backup.exe 836 backup.exe 1084 backup.exe 1920 backup.exe 1944 backup.exe 1392 data.exe 1040 backup.exe 1928 backup.exe 440 backup.exe 980 backup.exe 964 backup.exe 1752 backup.exe 1244 backup.exe 1648 backup.exe 1660 backup.exe 900 backup.exe 896 backup.exe 1900 backup.exe 268 backup.exe 672 backup.exe 1688 backup.exe 1984 backup.exe 2044 backup.exe 1064 backup.exe 556 backup.exe 1200 backup.exe 1988 backup.exe 824 backup.exe 1544 backup.exe 1944 backup.exe 1036 backup.exe 112 backup.exe 2012 backup.exe 1112 backup.exe 1960 backup.exe 1692 backup.exe 1364 backup.exe 1240 backup.exe 956 System Restore.exe 1784 data.exe 2032 backup.exe 1624 System Restore.exe 1628 backup.exe 1788 System Restore.exe 840 backup.exe 1360 data.exe 1640 backup.exe 2000 backup.exe 572 backup.exe 824 backup.exe 1564 backup.exe 1516 backup.exe 1984 backup.exe 1844 backup.exe 960 backup.exe 1492 backup.exe 976 data.exe -
Loads dropped DLL 64 IoCs
pid Process 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 688 backup.exe 688 backup.exe 836 backup.exe 836 backup.exe 688 backup.exe 688 backup.exe 1920 backup.exe 1920 backup.exe 1944 backup.exe 1944 backup.exe 1920 backup.exe 1920 backup.exe 1040 backup.exe 1040 backup.exe 1928 backup.exe 1928 backup.exe 1040 backup.exe 1040 backup.exe 688 backup.exe 688 backup.exe 1920 backup.exe 1920 backup.exe 1928 backup.exe 1928 backup.exe 1040 backup.exe 688 backup.exe 688 backup.exe 1040 backup.exe 1920 backup.exe 1920 backup.exe 1928 backup.exe 1928 backup.exe 1920 backup.exe 1920 backup.exe 1040 backup.exe 1040 backup.exe 1244 backup.exe 1244 backup.exe 900 backup.exe 900 backup.exe 1660 backup.exe 1660 backup.exe 1648 backup.exe 1648 backup.exe 1900 backup.exe 1900 backup.exe 1752 backup.exe 1752 backup.exe 964 backup.exe 964 backup.exe -
Drops file in Program Files directory 58 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\data.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe data.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\de-DE\backup.exe System Restore.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\System Restore.exe backup.exe File opened for modification C:\Windows\AppPatch\AppPatch64\backup.exe System Restore.exe File opened for modification C:\Windows\AppPatch\Custom\backup.exe System Restore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 968 System Restore.exe 1404 backup.exe 1744 backup.exe 336 data.exe 1372 backup.exe 672 backup.exe 688 backup.exe 1064 backup.exe 836 backup.exe 1084 backup.exe 1920 backup.exe 1944 backup.exe 1392 data.exe 1040 backup.exe 1928 backup.exe 440 backup.exe 980 backup.exe 964 backup.exe 1752 backup.exe 1244 backup.exe 1648 backup.exe 900 backup.exe 1660 backup.exe 896 backup.exe 1900 backup.exe 268 backup.exe 672 backup.exe 1200 backup.exe 1064 backup.exe 1988 backup.exe 2044 backup.exe 1688 backup.exe 1984 backup.exe 556 backup.exe 824 backup.exe 1944 backup.exe 112 backup.exe 2012 backup.exe 1544 backup.exe 1364 backup.exe 1036 backup.exe 1112 backup.exe 1960 backup.exe 1692 backup.exe 1784 data.exe 1240 backup.exe 1628 backup.exe 840 backup.exe 956 System Restore.exe 2032 backup.exe 1624 System Restore.exe 1788 System Restore.exe 1360 data.exe 1640 backup.exe 2000 backup.exe 572 backup.exe 824 backup.exe 1516 backup.exe 1492 backup.exe 960 backup.exe 1564 backup.exe 1304 backup.exe 976 data.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 968 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 27 PID 1712 wrote to memory of 968 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 27 PID 1712 wrote to memory of 968 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 27 PID 1712 wrote to memory of 968 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 27 PID 1712 wrote to memory of 1404 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 28 PID 1712 wrote to memory of 1404 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 28 PID 1712 wrote to memory of 1404 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 28 PID 1712 wrote to memory of 1404 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 28 PID 1712 wrote to memory of 1744 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 29 PID 1712 wrote to memory of 1744 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 29 PID 1712 wrote to memory of 1744 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 29 PID 1712 wrote to memory of 1744 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 29 PID 1712 wrote to memory of 336 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 30 PID 1712 wrote to memory of 336 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 30 PID 1712 wrote to memory of 336 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 30 PID 1712 wrote to memory of 336 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 30 PID 1712 wrote to memory of 1372 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 31 PID 1712 wrote to memory of 1372 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 31 PID 1712 wrote to memory of 1372 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 31 PID 1712 wrote to memory of 1372 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 31 PID 1712 wrote to memory of 672 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 32 PID 1712 wrote to memory of 672 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 32 PID 1712 wrote to memory of 672 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 32 PID 1712 wrote to memory of 672 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 32 PID 968 wrote to memory of 688 968 System Restore.exe 33 PID 968 wrote to memory of 688 968 System Restore.exe 33 PID 968 wrote to memory of 688 968 System Restore.exe 33 PID 968 wrote to memory of 688 968 System Restore.exe 33 PID 1712 wrote to memory of 1064 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 34 PID 1712 wrote to memory of 1064 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 34 PID 1712 wrote to memory of 1064 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 34 PID 1712 wrote to memory of 1064 1712 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe 34 PID 688 wrote to memory of 836 688 backup.exe 35 PID 688 wrote to memory of 836 688 backup.exe 35 PID 688 wrote to memory of 836 688 backup.exe 35 PID 688 wrote to memory of 836 688 backup.exe 35 PID 836 wrote to memory of 1084 836 backup.exe 36 PID 836 wrote to memory of 1084 836 backup.exe 36 PID 836 wrote to memory of 1084 836 backup.exe 36 PID 836 wrote to memory of 1084 836 backup.exe 36 PID 688 wrote to memory of 1920 688 backup.exe 37 PID 688 wrote to memory of 1920 688 backup.exe 37 PID 688 wrote to memory of 1920 688 backup.exe 37 PID 688 wrote to memory of 1920 688 backup.exe 37 PID 1920 wrote to memory of 1944 1920 backup.exe 38 PID 1920 wrote to memory of 1944 1920 backup.exe 38 PID 1920 wrote to memory of 1944 1920 backup.exe 38 PID 1920 wrote to memory of 1944 1920 backup.exe 38 PID 1944 wrote to memory of 1392 1944 backup.exe 39 PID 1944 wrote to memory of 1392 1944 backup.exe 39 PID 1944 wrote to memory of 1392 1944 backup.exe 39 PID 1944 wrote to memory of 1392 1944 backup.exe 39 PID 1920 wrote to memory of 1040 1920 backup.exe 40 PID 1920 wrote to memory of 1040 1920 backup.exe 40 PID 1920 wrote to memory of 1040 1920 backup.exe 40 PID 1920 wrote to memory of 1040 1920 backup.exe 40 PID 1040 wrote to memory of 1928 1040 backup.exe 41 PID 1040 wrote to memory of 1928 1040 backup.exe 41 PID 1040 wrote to memory of 1928 1040 backup.exe 41 PID 1040 wrote to memory of 1928 1040 backup.exe 41 PID 1928 wrote to memory of 440 1928 backup.exe 42 PID 1928 wrote to memory of 440 1928 backup.exe 42 PID 1928 wrote to memory of 440 1928 backup.exe 42 PID 1928 wrote to memory of 440 1928 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe"C:\Users\Admin\AppData\Local\Temp\20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\1644795293\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:968 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:688 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:836 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1084
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1920 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1944 -
C:\Program Files\7-Zip\Lang\data.exe"C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1392
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1040 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1244 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1624
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
PID:1844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵PID:1576
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:896 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:824
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:360
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1360 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1804
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:108
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1200
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1992
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:112
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:784
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:848
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1112
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:840
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:572
-
-
C:\Program Files\DVD Maker\it-IT\data.exe"C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1740
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1080
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:900 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1688 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1944 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:956 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1776
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1624
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:672 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1364
-
-
C:\Program Files\Internet Explorer\en-US\data.exe"C:\Program Files\Internet Explorer\en-US\data.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1784
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:824
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:2004
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:1800
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:1656
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1628
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1112
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:964 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:556 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1544 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1240
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:592
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1288
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:2008
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1280
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1368
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1784
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1660 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1516
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1036
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1608
-
-
C:\Users\Admin\Links\update.exeC:\Users\Admin\Links\update.exe C:\Users\Admin\Links\6⤵PID:1916
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:840
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1900 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1036
-
-
C:\Windows\AppPatch\System Restore.exe"C:\Windows\AppPatch\System Restore.exe" C:\Windows\AppPatch\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1788 -
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
C:\Windows\AppPatch\Custom\backup.exeC:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\6⤵PID:1960
-
-
C:\Windows\AppPatch\de-DE\backup.exeC:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\6⤵PID:1348
-
-
C:\Windows\AppPatch\en-US\backup.exeC:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\6⤵PID:1404
-
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:808
-
C:\Windows\assembly\GAC\backup.exeC:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\6⤵PID:2024
-
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:1364
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:336
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:672
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5b2bba64bbd2c59cf57062866c037c54d
SHA1f3a0aeeae1d074638bfa6eb6869d42227ceca161
SHA256eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193
SHA512d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998
-
Filesize
72KB
MD5a9649987cede809582138a81231edc44
SHA16f794d2a850f1268b5dc032a3b7c149c7f5bc94f
SHA256582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c
SHA512f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7
-
Filesize
72KB
MD5a9649987cede809582138a81231edc44
SHA16f794d2a850f1268b5dc032a3b7c149c7f5bc94f
SHA256582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c
SHA512f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7
-
Filesize
72KB
MD5f1e48727987f0884d21a1a2300b8491e
SHA1505b7818aa30d84833bf03e7d56f7f0b5f456b8c
SHA256c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4
SHA512772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD533f18b9436f1c71f2af6e975f327115c
SHA1c02310867b895954b85e4e748d48beca3b2f03bf
SHA25613920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d
SHA512f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD5d634fa085cde5e91f623643c4c9bf45b
SHA18dca033ce4c9baffd7a94ef05dc0cf04bb500e12
SHA256971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d
SHA51241586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD5dee18dd1bade284a420b72462ed970c5
SHA105fb9544d0c416fee8ab962bf99b38511bc923af
SHA256c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960
SHA512c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44
-
Filesize
72KB
MD5665c8b8832e0c83c39633155bfbaea77
SHA1e6977529e69df9afa187434abb7b4e2d371e60d5
SHA25635d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa
SHA51216b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871
-
Filesize
72KB
MD5665c8b8832e0c83c39633155bfbaea77
SHA1e6977529e69df9afa187434abb7b4e2d371e60d5
SHA25635d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa
SHA51216b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
Filesize72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5cd32f587821c58e3146923e96265f92e
SHA1a3cf848769f729a675ea20ba4b0d0fe6ada44b94
SHA2568bf7399e01496cbba55133d038941bf148b397f823effe9298b964d58ed60e84
SHA51269c484c5f06a8777f42cc1f9c9f30ac5bc1a64b401b47b0e702ecd9be67f8d757de8cb40e92470aeebfeb38cda823920c888a732429ac85c0a66c6569b7c7aa2
-
Filesize
72KB
MD5cd32f587821c58e3146923e96265f92e
SHA1a3cf848769f729a675ea20ba4b0d0fe6ada44b94
SHA2568bf7399e01496cbba55133d038941bf148b397f823effe9298b964d58ed60e84
SHA51269c484c5f06a8777f42cc1f9c9f30ac5bc1a64b401b47b0e702ecd9be67f8d757de8cb40e92470aeebfeb38cda823920c888a732429ac85c0a66c6569b7c7aa2
-
Filesize
72KB
MD5b2bba64bbd2c59cf57062866c037c54d
SHA1f3a0aeeae1d074638bfa6eb6869d42227ceca161
SHA256eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193
SHA512d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998
-
Filesize
72KB
MD5b2bba64bbd2c59cf57062866c037c54d
SHA1f3a0aeeae1d074638bfa6eb6869d42227ceca161
SHA256eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193
SHA512d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998
-
Filesize
72KB
MD5a9649987cede809582138a81231edc44
SHA16f794d2a850f1268b5dc032a3b7c149c7f5bc94f
SHA256582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c
SHA512f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7
-
Filesize
72KB
MD5a9649987cede809582138a81231edc44
SHA16f794d2a850f1268b5dc032a3b7c149c7f5bc94f
SHA256582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c
SHA512f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7
-
Filesize
72KB
MD5f1e48727987f0884d21a1a2300b8491e
SHA1505b7818aa30d84833bf03e7d56f7f0b5f456b8c
SHA256c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4
SHA512772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb
-
Filesize
72KB
MD5f1e48727987f0884d21a1a2300b8491e
SHA1505b7818aa30d84833bf03e7d56f7f0b5f456b8c
SHA256c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4
SHA512772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD533f18b9436f1c71f2af6e975f327115c
SHA1c02310867b895954b85e4e748d48beca3b2f03bf
SHA25613920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d
SHA512f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b
-
Filesize
72KB
MD533f18b9436f1c71f2af6e975f327115c
SHA1c02310867b895954b85e4e748d48beca3b2f03bf
SHA25613920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d
SHA512f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD5a28a15c096fe78cb2d53a00ae142ed59
SHA15d54e19d4bf0e3a277ff29fd17f4550282839c62
SHA2562add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b
SHA5121584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e
-
Filesize
72KB
MD533f18b9436f1c71f2af6e975f327115c
SHA1c02310867b895954b85e4e748d48beca3b2f03bf
SHA25613920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d
SHA512f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b
-
Filesize
72KB
MD533f18b9436f1c71f2af6e975f327115c
SHA1c02310867b895954b85e4e748d48beca3b2f03bf
SHA25613920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d
SHA512f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b
-
Filesize
72KB
MD5d634fa085cde5e91f623643c4c9bf45b
SHA18dca033ce4c9baffd7a94ef05dc0cf04bb500e12
SHA256971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d
SHA51241586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa
-
Filesize
72KB
MD5d634fa085cde5e91f623643c4c9bf45b
SHA18dca033ce4c9baffd7a94ef05dc0cf04bb500e12
SHA256971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d
SHA51241586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD57a95b97eae5d7288c02e87ed03902d03
SHA14c1c46af4c47c9dec5ede1c92d56d4d541e6fb93
SHA2569650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960
SHA512e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a
-
Filesize
72KB
MD5dee18dd1bade284a420b72462ed970c5
SHA105fb9544d0c416fee8ab962bf99b38511bc923af
SHA256c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960
SHA512c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44
-
Filesize
72KB
MD5dee18dd1bade284a420b72462ed970c5
SHA105fb9544d0c416fee8ab962bf99b38511bc923af
SHA256c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960
SHA512c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44
-
Filesize
72KB
MD5665c8b8832e0c83c39633155bfbaea77
SHA1e6977529e69df9afa187434abb7b4e2d371e60d5
SHA25635d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa
SHA51216b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871
-
Filesize
72KB
MD5665c8b8832e0c83c39633155bfbaea77
SHA1e6977529e69df9afa187434abb7b4e2d371e60d5
SHA25635d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa
SHA51216b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
Filesize72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
Filesize72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5657b2093b71955e34a599b7a6eb9d6cc
SHA1e1c23aec2d110711d5f61189202ef2b2bfe1ae6a
SHA2567a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01
SHA512099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52
-
Filesize
72KB
MD5f4b2f128bc0fd1d155baa5380ee5c0ab
SHA1117d848bd407485aff8d2057d5cfad3e422b7aaa
SHA2566586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2
SHA512261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52