Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:29
Static task
static1
Behavioral task
behavioral1
Sample
a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe
Resource
win10v2004-20220812-en
General
-
Target
a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe
-
Size
72KB
-
MD5
0679afb5dee70927aba930dc1899e776
-
SHA1
d95dc0fa4e60eb1dcbb0dc97eddea63da7563277
-
SHA256
a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5
-
SHA512
9cd420b699eefd7833ac08d77fbdc6a453c080745619dbdea407d48fb607e5c9b90b00ab301df1e756d4af1e4cf9215bf6b2208c55f755f241f0a2406d8c7b2d
-
SSDEEP
768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyvUow:HeT7BVwxfvqguKRFAbP
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 62 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1704 backup.exe 1552 backup.exe 1404 backup.exe 896 backup.exe 1796 backup.exe 620 update.exe 108 backup.exe 808 backup.exe 1768 backup.exe 1340 backup.exe 760 backup.exe 1260 backup.exe 1692 backup.exe 1124 backup.exe 1160 backup.exe 580 backup.exe 1004 backup.exe 1616 backup.exe 612 backup.exe 1360 backup.exe 1396 backup.exe 1272 backup.exe 976 backup.exe 1796 backup.exe 964 backup.exe 752 backup.exe 840 backup.exe 888 backup.exe 1828 backup.exe 708 update.exe 1232 backup.exe 1744 backup.exe 1892 backup.exe 2008 backup.exe 1480 backup.exe 1020 backup.exe 1888 backup.exe 1412 backup.exe 1032 backup.exe 804 backup.exe 1596 backup.exe 1016 backup.exe 1760 data.exe 1516 backup.exe 1680 backup.exe 1152 backup.exe 536 backup.exe 896 backup.exe 1784 backup.exe 860 backup.exe 1168 backup.exe 1976 backup.exe 1548 backup.exe 888 backup.exe 1732 backup.exe 1476 backup.exe 1260 backup.exe 1804 backup.exe 1928 data.exe 1744 backup.exe 276 backup.exe 1648 backup.exe 804 backup.exe 1336 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 108 backup.exe 108 backup.exe 808 backup.exe 808 backup.exe 108 backup.exe 108 backup.exe 1340 backup.exe 1340 backup.exe 760 backup.exe 760 backup.exe 1340 backup.exe 1340 backup.exe 1692 backup.exe 1692 backup.exe 1124 backup.exe 1124 backup.exe 1124 backup.exe 1124 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 620 update.exe 620 update.exe 620 update.exe 580 backup.exe 580 backup.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 108 backup.exe 580 backup.exe 1340 backup.exe 1340 backup.exe 708 update.exe 708 update.exe 708 update.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files (x86)\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\data.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 1704 backup.exe 1552 backup.exe 1404 backup.exe 896 backup.exe 1796 backup.exe 108 backup.exe 808 backup.exe 1768 backup.exe 1340 backup.exe 760 backup.exe 1260 backup.exe 1692 backup.exe 1124 backup.exe 1160 backup.exe 580 backup.exe 1004 backup.exe 1616 backup.exe 620 update.exe 612 backup.exe 1360 backup.exe 1396 backup.exe 1272 backup.exe 976 backup.exe 1796 backup.exe 964 backup.exe 752 backup.exe 840 backup.exe 888 backup.exe 1828 backup.exe 708 update.exe 1232 backup.exe 1892 backup.exe 1744 backup.exe 2008 backup.exe 1480 backup.exe 1020 backup.exe 1888 backup.exe 1412 backup.exe 1596 backup.exe 1032 backup.exe 1016 backup.exe 1760 data.exe 1516 backup.exe 1680 backup.exe 1152 backup.exe 536 backup.exe 896 backup.exe 1784 backup.exe 1168 backup.exe 860 backup.exe 1976 backup.exe 1548 backup.exe 888 backup.exe 1476 backup.exe 1804 backup.exe 1260 backup.exe 1928 data.exe 1744 backup.exe 276 backup.exe 1336 backup.exe 1612 update.exe 1596 backup.exe 1552 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1704 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 28 PID 1620 wrote to memory of 1704 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 28 PID 1620 wrote to memory of 1704 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 28 PID 1620 wrote to memory of 1704 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 28 PID 1620 wrote to memory of 1552 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 29 PID 1620 wrote to memory of 1552 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 29 PID 1620 wrote to memory of 1552 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 29 PID 1620 wrote to memory of 1552 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 29 PID 1620 wrote to memory of 1404 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 30 PID 1620 wrote to memory of 1404 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 30 PID 1620 wrote to memory of 1404 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 30 PID 1620 wrote to memory of 1404 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 30 PID 1620 wrote to memory of 896 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 31 PID 1620 wrote to memory of 896 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 31 PID 1620 wrote to memory of 896 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 31 PID 1620 wrote to memory of 896 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 31 PID 1620 wrote to memory of 1796 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 32 PID 1620 wrote to memory of 1796 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 32 PID 1620 wrote to memory of 1796 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 32 PID 1620 wrote to memory of 1796 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 32 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1620 wrote to memory of 620 1620 a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe 33 PID 1704 wrote to memory of 108 1704 backup.exe 34 PID 1704 wrote to memory of 108 1704 backup.exe 34 PID 1704 wrote to memory of 108 1704 backup.exe 34 PID 1704 wrote to memory of 108 1704 backup.exe 34 PID 108 wrote to memory of 808 108 backup.exe 35 PID 108 wrote to memory of 808 108 backup.exe 35 PID 108 wrote to memory of 808 108 backup.exe 35 PID 108 wrote to memory of 808 108 backup.exe 35 PID 808 wrote to memory of 1768 808 backup.exe 36 PID 808 wrote to memory of 1768 808 backup.exe 36 PID 808 wrote to memory of 1768 808 backup.exe 36 PID 808 wrote to memory of 1768 808 backup.exe 36 PID 108 wrote to memory of 1340 108 backup.exe 37 PID 108 wrote to memory of 1340 108 backup.exe 37 PID 108 wrote to memory of 1340 108 backup.exe 37 PID 108 wrote to memory of 1340 108 backup.exe 37 PID 1340 wrote to memory of 760 1340 backup.exe 38 PID 1340 wrote to memory of 760 1340 backup.exe 38 PID 1340 wrote to memory of 760 1340 backup.exe 38 PID 1340 wrote to memory of 760 1340 backup.exe 38 PID 760 wrote to memory of 1260 760 backup.exe 39 PID 760 wrote to memory of 1260 760 backup.exe 39 PID 760 wrote to memory of 1260 760 backup.exe 39 PID 760 wrote to memory of 1260 760 backup.exe 39 PID 1340 wrote to memory of 1692 1340 backup.exe 40 PID 1340 wrote to memory of 1692 1340 backup.exe 40 PID 1340 wrote to memory of 1692 1340 backup.exe 40 PID 1340 wrote to memory of 1692 1340 backup.exe 40 PID 1692 wrote to memory of 1124 1692 backup.exe 41 PID 1692 wrote to memory of 1124 1692 backup.exe 41 PID 1692 wrote to memory of 1124 1692 backup.exe 41 PID 1692 wrote to memory of 1124 1692 backup.exe 41 PID 1124 wrote to memory of 1160 1124 backup.exe 42 PID 1124 wrote to memory of 1160 1124 backup.exe 42 PID 1124 wrote to memory of 1160 1124 backup.exe 42 PID 1124 wrote to memory of 1160 1124 backup.exe 42 PID 1124 wrote to memory of 580 1124 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe"C:\Users\Admin\AppData\Local\Temp\a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\839000494\backup.exeC:\Users\Admin\AppData\Local\Temp\839000494\backup.exe C:\Users\Admin\AppData\Local\Temp\839000494\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:808 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1340 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1692 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1124 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1160
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1272
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1796
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:840
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1828 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1412
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1476
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:1484
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:1272
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1424
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1892 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1016
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1784
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
PID:1732
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1524
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:2000
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1336 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1680
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:988
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1480 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:804
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1516 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:896 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:276
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:688
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1772
-
-
-
C:\Program Files\Common Files\System\de-DE\update.exe"C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:656
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:892
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1468
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1232 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2008
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1152
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1168
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1804
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1564
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Suspicious use of SetWindowsHookEx
PID:1596 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1368
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1260
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1592
-
-
-
C:\Program Files (x86)\update.exe"C:\Program Files (x86)\update.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:708 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1020 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1032 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:980
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:620
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1588 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:368
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:288
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1532
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
PID:804
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1640
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:432
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1776
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:896
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1796
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:620
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1360
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5faa50fb5e8710b94a871adda37166669
SHA1735ab0f2020fc03cdc126ba9eea8a10779034faa
SHA2568d9fc0361bd0fe813aa31ce21be476c2423ebfdd22f07f0ee0eb7f40c063cc8f
SHA51263e33ef502c4b10263523cc4362006095a4b568cb38fa5912956ca3d4a4eee78bdd3f359e263d77626d8ca6f6d9577b3831f06c97f41a3c3ed60e20a3449cb5c
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD54904ffd3ad1865009da7160a49a11b3c
SHA11d0342ffedbd7aff46151371aa14dc2c406edd7f
SHA256a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e
SHA51295029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4
-
Filesize
72KB
MD54904ffd3ad1865009da7160a49a11b3c
SHA11d0342ffedbd7aff46151371aa14dc2c406edd7f
SHA256a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e
SHA51295029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4
-
Filesize
72KB
MD538e409e2cf6c09238410a5e4feced2a4
SHA1f5853d7fd4d718c571cdfa334cd49c37bfb7f448
SHA256f8b6d5e7312d717560fccd865644d39e8ac2791383151c70a94dc77e9358da78
SHA5127250389e809ea1bfa387dd29369b6f49697054ae7769bbfc70649875adb2f25fa5e1d67222294f97be9418b2b032841ab8006e8a20420675c636d8cc03d6f0fe
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD547bd4736a1da2761bee5365a5e1546e3
SHA1afa85396ff9d54d2bf5060df185c938ea4d57b5b
SHA25675a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e
SHA51257333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac
-
Filesize
72KB
MD55dfa3dd6a6666a8841dae4f56d144c8b
SHA1761b27daec0f7df79776c81d1252b1bca04a845a
SHA2568eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b
SHA512f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9
-
Filesize
72KB
MD55dfa3dd6a6666a8841dae4f56d144c8b
SHA1761b27daec0f7df79776c81d1252b1bca04a845a
SHA2568eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b
SHA512f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD509ce44ec7fdd1070f5eb05def95d1d49
SHA10e73f461f5e00ba6b56e4e43db553294711ec020
SHA25698a108d0f658ff34face6dcee3be6c2b014b35fb53221503c0c207092a091284
SHA512eed9aba7b945c3fb9bf5af15b14ff5e6c678924ea76d4be878b0dee40ec4c18474198dbced4cdede202a4522282e8505934e7aa868244fa62fb42928d8014b2b
-
Filesize
72KB
MD509ce44ec7fdd1070f5eb05def95d1d49
SHA10e73f461f5e00ba6b56e4e43db553294711ec020
SHA25698a108d0f658ff34face6dcee3be6c2b014b35fb53221503c0c207092a091284
SHA512eed9aba7b945c3fb9bf5af15b14ff5e6c678924ea76d4be878b0dee40ec4c18474198dbced4cdede202a4522282e8505934e7aa868244fa62fb42928d8014b2b
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5faa50fb5e8710b94a871adda37166669
SHA1735ab0f2020fc03cdc126ba9eea8a10779034faa
SHA2568d9fc0361bd0fe813aa31ce21be476c2423ebfdd22f07f0ee0eb7f40c063cc8f
SHA51263e33ef502c4b10263523cc4362006095a4b568cb38fa5912956ca3d4a4eee78bdd3f359e263d77626d8ca6f6d9577b3831f06c97f41a3c3ed60e20a3449cb5c
-
Filesize
72KB
MD5faa50fb5e8710b94a871adda37166669
SHA1735ab0f2020fc03cdc126ba9eea8a10779034faa
SHA2568d9fc0361bd0fe813aa31ce21be476c2423ebfdd22f07f0ee0eb7f40c063cc8f
SHA51263e33ef502c4b10263523cc4362006095a4b568cb38fa5912956ca3d4a4eee78bdd3f359e263d77626d8ca6f6d9577b3831f06c97f41a3c3ed60e20a3449cb5c
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD57a6b6048bd17f2f03782ea4f78349f5a
SHA1eafa0926a92b9438c6812342aae93df0bae53913
SHA2568014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d
SHA5123ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD54904ffd3ad1865009da7160a49a11b3c
SHA11d0342ffedbd7aff46151371aa14dc2c406edd7f
SHA256a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e
SHA51295029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4
-
Filesize
72KB
MD54904ffd3ad1865009da7160a49a11b3c
SHA11d0342ffedbd7aff46151371aa14dc2c406edd7f
SHA256a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e
SHA51295029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4
-
Filesize
72KB
MD538e409e2cf6c09238410a5e4feced2a4
SHA1f5853d7fd4d718c571cdfa334cd49c37bfb7f448
SHA256f8b6d5e7312d717560fccd865644d39e8ac2791383151c70a94dc77e9358da78
SHA5127250389e809ea1bfa387dd29369b6f49697054ae7769bbfc70649875adb2f25fa5e1d67222294f97be9418b2b032841ab8006e8a20420675c636d8cc03d6f0fe
-
Filesize
72KB
MD538e409e2cf6c09238410a5e4feced2a4
SHA1f5853d7fd4d718c571cdfa334cd49c37bfb7f448
SHA256f8b6d5e7312d717560fccd865644d39e8ac2791383151c70a94dc77e9358da78
SHA5127250389e809ea1bfa387dd29369b6f49697054ae7769bbfc70649875adb2f25fa5e1d67222294f97be9418b2b032841ab8006e8a20420675c636d8cc03d6f0fe
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD5162c84c7a4ce86d0638661fa01b2f74b
SHA1077de51ce9d885fbb6f14595643a7d03d9809b4f
SHA25635a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f
SHA512f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd
-
Filesize
72KB
MD547bd4736a1da2761bee5365a5e1546e3
SHA1afa85396ff9d54d2bf5060df185c938ea4d57b5b
SHA25675a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e
SHA51257333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac
-
Filesize
72KB
MD547bd4736a1da2761bee5365a5e1546e3
SHA1afa85396ff9d54d2bf5060df185c938ea4d57b5b
SHA25675a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e
SHA51257333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac
-
Filesize
72KB
MD547bd4736a1da2761bee5365a5e1546e3
SHA1afa85396ff9d54d2bf5060df185c938ea4d57b5b
SHA25675a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e
SHA51257333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac
-
Filesize
72KB
MD55dfa3dd6a6666a8841dae4f56d144c8b
SHA1761b27daec0f7df79776c81d1252b1bca04a845a
SHA2568eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b
SHA512f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9
-
Filesize
72KB
MD55dfa3dd6a6666a8841dae4f56d144c8b
SHA1761b27daec0f7df79776c81d1252b1bca04a845a
SHA2568eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b
SHA512f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5bc5bc052d95c7e9b36778b8c7d9649d0
SHA1caf08892c892ec485576596f718549f111fcdc7f
SHA25618b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8
SHA5127642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD5b66366e028d942eef45c07ff8df4fc4a
SHA1ce25f06436692b2f4c2e23b5101194b932989918
SHA256b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d
SHA5124e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470
-
Filesize
72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439
-
Filesize
72KB
MD54351ed79f6e2b4d031e7238a7cb7b193
SHA15f3f2732382686eac64f9281de672849b9fce4a1
SHA256b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11
SHA51299eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439