Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe
Resource
win10v2004-20220812-en
General
-
Target
1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe
-
Size
72KB
-
MD5
0d331caf48b12caeb9c7276dbebec2c1
-
SHA1
4c3d05214ef20a2eeebf9b6b0e5a1841888df9dc
-
SHA256
1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74
-
SHA512
336c1926e13e4cd351258a8dc9974d66f7205bb979f68cf7b314f083a796dfb2c7de934514c9115106bc92980c49bbd21acf807a0fe87f7dbdfd06e00a879b6b
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2L:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrX
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 29 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 58 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 40 IoCs
pid Process 1168 data.exe 1536 backup.exe 1456 backup.exe 1248 backup.exe 1700 backup.exe 1768 backup.exe 1712 backup.exe 1068 backup.exe 1688 backup.exe 332 backup.exe 2028 update.exe 1752 backup.exe 644 backup.exe 364 backup.exe 1984 backup.exe 1552 backup.exe 1048 backup.exe 2024 backup.exe 1308 backup.exe 1388 backup.exe 1604 backup.exe 1248 backup.exe 320 backup.exe 1364 backup.exe 1828 backup.exe 396 backup.exe 1652 backup.exe 1672 backup.exe 1068 backup.exe 1660 System Restore.exe 740 backup.exe 1468 backup.exe 1548 backup.exe 960 backup.exe 388 data.exe 556 backup.exe 908 backup.exe 1092 backup.exe 1964 backup.exe 848 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 1712 backup.exe 1712 backup.exe 1688 backup.exe 1688 backup.exe 1712 backup.exe 2028 update.exe 2028 update.exe 2028 update.exe 2028 update.exe 2028 update.exe 1752 backup.exe 1752 backup.exe 1752 backup.exe 1752 backup.exe 1752 backup.exe 644 backup.exe 644 backup.exe 644 backup.exe 2028 update.exe 2028 update.exe 364 backup.exe 364 backup.exe 364 backup.exe 364 backup.exe 364 backup.exe 1984 backup.exe 1984 backup.exe 1984 backup.exe 1984 backup.exe 1984 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1984 backup.exe 1984 backup.exe 1048 backup.exe 1048 backup.exe 1048 backup.exe 1048 backup.exe 1048 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 1048 backup.exe 1048 backup.exe 1308 backup.exe 1308 backup.exe 1308 backup.exe 1048 backup.exe 1048 backup.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe update.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe update.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 34 IoCs
pid Process 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 1168 data.exe 1536 backup.exe 1456 backup.exe 1248 backup.exe 1700 backup.exe 1768 backup.exe 1712 backup.exe 1068 backup.exe 1688 backup.exe 332 backup.exe 2028 update.exe 1752 backup.exe 644 backup.exe 364 backup.exe 1984 backup.exe 1552 backup.exe 1048 backup.exe 2024 backup.exe 1308 backup.exe 1388 backup.exe 1364 backup.exe 1604 backup.exe 1248 backup.exe 320 backup.exe 396 backup.exe 1652 backup.exe 1828 backup.exe 1672 backup.exe 1068 backup.exe 1548 backup.exe 1468 backup.exe 740 backup.exe 1660 System Restore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 932 wrote to memory of 1168 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 27 PID 932 wrote to memory of 1168 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 27 PID 932 wrote to memory of 1168 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 27 PID 932 wrote to memory of 1168 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 27 PID 932 wrote to memory of 1536 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 28 PID 932 wrote to memory of 1536 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 28 PID 932 wrote to memory of 1536 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 28 PID 932 wrote to memory of 1536 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 28 PID 932 wrote to memory of 1456 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 29 PID 932 wrote to memory of 1456 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 29 PID 932 wrote to memory of 1456 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 29 PID 932 wrote to memory of 1456 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 29 PID 932 wrote to memory of 1248 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 30 PID 932 wrote to memory of 1248 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 30 PID 932 wrote to memory of 1248 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 30 PID 932 wrote to memory of 1248 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 30 PID 932 wrote to memory of 1700 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 31 PID 932 wrote to memory of 1700 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 31 PID 932 wrote to memory of 1700 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 31 PID 932 wrote to memory of 1700 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 31 PID 932 wrote to memory of 1768 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 32 PID 932 wrote to memory of 1768 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 32 PID 932 wrote to memory of 1768 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 32 PID 932 wrote to memory of 1768 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 32 PID 1168 wrote to memory of 1712 1168 data.exe 33 PID 1168 wrote to memory of 1712 1168 data.exe 33 PID 1168 wrote to memory of 1712 1168 data.exe 33 PID 1168 wrote to memory of 1712 1168 data.exe 33 PID 932 wrote to memory of 1068 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 34 PID 932 wrote to memory of 1068 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 34 PID 932 wrote to memory of 1068 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 34 PID 932 wrote to memory of 1068 932 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe 34 PID 1712 wrote to memory of 1688 1712 backup.exe 35 PID 1712 wrote to memory of 1688 1712 backup.exe 35 PID 1712 wrote to memory of 1688 1712 backup.exe 35 PID 1712 wrote to memory of 1688 1712 backup.exe 35 PID 1688 wrote to memory of 332 1688 backup.exe 36 PID 1688 wrote to memory of 332 1688 backup.exe 36 PID 1688 wrote to memory of 332 1688 backup.exe 36 PID 1688 wrote to memory of 332 1688 backup.exe 36 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 1712 wrote to memory of 2028 1712 backup.exe 37 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 2028 wrote to memory of 1752 2028 update.exe 38 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 1752 wrote to memory of 644 1752 backup.exe 39 PID 2028 wrote to memory of 364 2028 update.exe 40 PID 2028 wrote to memory of 364 2028 update.exe 40 PID 2028 wrote to memory of 364 2028 update.exe 40 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe"C:\Users\Admin\AppData\Local\Temp\1743332ea14662f882b51e9e328a76582afb8765fee6d9c34654b72855c4ca74.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:932 -
C:\Users\Admin\AppData\Local\Temp\1721135695\data.exeC:\Users\Admin\AppData\Local\Temp\1721135695\data.exe C:\Users\Admin\AppData\Local\Temp\1721135695\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1168 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1688 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:332
-
-
-
C:\Program Files\update.exe"C:\Program Files\update.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1752 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:644
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:364 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1048 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1388
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
PID:960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵PID:1504
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵PID:1120
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1364 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1716
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1700
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1672 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Executes dropped EXE
PID:388
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:592
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:892
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:320
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1828 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
PID:908
-
-
-
C:\Program Files\Common Files\System\System Restore.exe"C:\Program Files\Common Files\System\System Restore.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:1588
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1308
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:836
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
PID:848
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1388
-
-
C:\Program Files\DVD Maker\es-ES\update.exe"C:\Program Files\DVD Maker\es-ES\update.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:364
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1652 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Executes dropped EXE
PID:1964 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:1744
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:740 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:964
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:1428
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1972
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:2012
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1264
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1248 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
PID:556
-
-
C:\Program Files (x86)\Common Files\data.exe"C:\Program Files (x86)\Common Files\data.exe" C:\Program Files (x86)\Common Files\5⤵PID:1572
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1936
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:396 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Executes dropped EXE
PID:1092
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1728
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1924
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:544
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1248
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1068
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5f0180df6ceabb53fa4b24d63cbbec68e
SHA1067f9ac0653332752034844ddb9db525c41875e1
SHA25644f8448d9937ab7312e3a7c8712113039fce4ee1e29acf387e6ed51a60a15232
SHA5122c0b4cd2f0394c78d4b16d8c589fd677a643da5b508a1ec82bbc3938622eed7cd899059d5f70b078b702a54e418261346c9d704bfff840d16aae2d2070b9e317
-
Filesize
72KB
MD5c589d4f996743eabe22bae531acea9a8
SHA15b10efe9b7f9b40126e26e9c505e19b18bee2e01
SHA2560d8ba211ae1ff068c71d473a38eafe48a57704e482520e4036f6322ff779a186
SHA51273c749bbbef22b30b76601f73368a3361114f3aab5b44621d019f039391dbbe04bb434fd3aadb6f750b42c440d308c7b6d45a124e94a54171ce10bccdc502b56
-
Filesize
72KB
MD5c589d4f996743eabe22bae531acea9a8
SHA15b10efe9b7f9b40126e26e9c505e19b18bee2e01
SHA2560d8ba211ae1ff068c71d473a38eafe48a57704e482520e4036f6322ff779a186
SHA51273c749bbbef22b30b76601f73368a3361114f3aab5b44621d019f039391dbbe04bb434fd3aadb6f750b42c440d308c7b6d45a124e94a54171ce10bccdc502b56
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5aecb730ee8551a965847a440274113ac
SHA10433b2c4a1b5a42fa7f0f40bc4eb0189c6ff3e7f
SHA256df05bd45b2a018014002c6c882376e31a031efc2637cb753391d60b73a962808
SHA51221637d82172af64dfd7520e8872352f6079f891a13d6e9a3eae1c1217db7d232c075a695857048052b65dbc06fc66b36354a09782ac50e1570009d194b9565fd
-
Filesize
72KB
MD5aecb730ee8551a965847a440274113ac
SHA10433b2c4a1b5a42fa7f0f40bc4eb0189c6ff3e7f
SHA256df05bd45b2a018014002c6c882376e31a031efc2637cb753391d60b73a962808
SHA51221637d82172af64dfd7520e8872352f6079f891a13d6e9a3eae1c1217db7d232c075a695857048052b65dbc06fc66b36354a09782ac50e1570009d194b9565fd
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD5557e67fdbc6a2cbca00570329cbfbe0c
SHA1fc846884a6ceb6b3c9d38eb98fce16b11992e8fc
SHA25603d95ad3a87f12840ce5d1bf0aef441232158d6b0ea06d00816badfba8b13dcc
SHA5123105c55b53c5fa86256e16abda1987acf9e1424c4a5af7b3be12730c2452aa8712b5c46d4dfdde4827a87ba4da96a8826708c2fdcd8b656420725c552fd725ab
-
Filesize
72KB
MD5557e67fdbc6a2cbca00570329cbfbe0c
SHA1fc846884a6ceb6b3c9d38eb98fce16b11992e8fc
SHA25603d95ad3a87f12840ce5d1bf0aef441232158d6b0ea06d00816badfba8b13dcc
SHA5123105c55b53c5fa86256e16abda1987acf9e1424c4a5af7b3be12730c2452aa8712b5c46d4dfdde4827a87ba4da96a8826708c2fdcd8b656420725c552fd725ab
-
Filesize
72KB
MD5f0180df6ceabb53fa4b24d63cbbec68e
SHA1067f9ac0653332752034844ddb9db525c41875e1
SHA25644f8448d9937ab7312e3a7c8712113039fce4ee1e29acf387e6ed51a60a15232
SHA5122c0b4cd2f0394c78d4b16d8c589fd677a643da5b508a1ec82bbc3938622eed7cd899059d5f70b078b702a54e418261346c9d704bfff840d16aae2d2070b9e317
-
Filesize
72KB
MD5f0180df6ceabb53fa4b24d63cbbec68e
SHA1067f9ac0653332752034844ddb9db525c41875e1
SHA25644f8448d9937ab7312e3a7c8712113039fce4ee1e29acf387e6ed51a60a15232
SHA5122c0b4cd2f0394c78d4b16d8c589fd677a643da5b508a1ec82bbc3938622eed7cd899059d5f70b078b702a54e418261346c9d704bfff840d16aae2d2070b9e317
-
Filesize
72KB
MD5c589d4f996743eabe22bae531acea9a8
SHA15b10efe9b7f9b40126e26e9c505e19b18bee2e01
SHA2560d8ba211ae1ff068c71d473a38eafe48a57704e482520e4036f6322ff779a186
SHA51273c749bbbef22b30b76601f73368a3361114f3aab5b44621d019f039391dbbe04bb434fd3aadb6f750b42c440d308c7b6d45a124e94a54171ce10bccdc502b56
-
Filesize
72KB
MD5c589d4f996743eabe22bae531acea9a8
SHA15b10efe9b7f9b40126e26e9c505e19b18bee2e01
SHA2560d8ba211ae1ff068c71d473a38eafe48a57704e482520e4036f6322ff779a186
SHA51273c749bbbef22b30b76601f73368a3361114f3aab5b44621d019f039391dbbe04bb434fd3aadb6f750b42c440d308c7b6d45a124e94a54171ce10bccdc502b56
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD517316679f6add61013099875215d1207
SHA1a8001a56deaba0da0ecf3f8c46885e9d70b8f63e
SHA25643aebf70954cde4de06a96e8cc90ca35bce3c1eef070bd21213694eb42fa5cb4
SHA5120014582ff7b7ad86e2f36cc0cc2d203b5ce27bd403a95236268e40b4d7094d3db06ad69db3582412aa9fbe0734cbe90d334be3c673930d118f88a6d3bd3e2e18
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5ddf9a7668c9b6fa75e8aafddad17beb5
SHA1a7b5d0cfe6ada1a6bb7aab0d73855d30aa5c01dc
SHA2562310173fab1ea54e4e84a0166658187235ca7a52b8768fb75cf7c12fd7de6c03
SHA512fec3cb750a4015a6578936b7020a1cfcdd2c6acb008c90ad46f5cdab18bb86324b8a27cc57baba3ccb6cb1ad8dca3584b38d449dd7c620f39e9eb05bb2b0da36
-
Filesize
72KB
MD5aecb730ee8551a965847a440274113ac
SHA10433b2c4a1b5a42fa7f0f40bc4eb0189c6ff3e7f
SHA256df05bd45b2a018014002c6c882376e31a031efc2637cb753391d60b73a962808
SHA51221637d82172af64dfd7520e8872352f6079f891a13d6e9a3eae1c1217db7d232c075a695857048052b65dbc06fc66b36354a09782ac50e1570009d194b9565fd
-
Filesize
72KB
MD5aecb730ee8551a965847a440274113ac
SHA10433b2c4a1b5a42fa7f0f40bc4eb0189c6ff3e7f
SHA256df05bd45b2a018014002c6c882376e31a031efc2637cb753391d60b73a962808
SHA51221637d82172af64dfd7520e8872352f6079f891a13d6e9a3eae1c1217db7d232c075a695857048052b65dbc06fc66b36354a09782ac50e1570009d194b9565fd
-
Filesize
72KB
MD5aecb730ee8551a965847a440274113ac
SHA10433b2c4a1b5a42fa7f0f40bc4eb0189c6ff3e7f
SHA256df05bd45b2a018014002c6c882376e31a031efc2637cb753391d60b73a962808
SHA51221637d82172af64dfd7520e8872352f6079f891a13d6e9a3eae1c1217db7d232c075a695857048052b65dbc06fc66b36354a09782ac50e1570009d194b9565fd
-
Filesize
72KB
MD5aecb730ee8551a965847a440274113ac
SHA10433b2c4a1b5a42fa7f0f40bc4eb0189c6ff3e7f
SHA256df05bd45b2a018014002c6c882376e31a031efc2637cb753391d60b73a962808
SHA51221637d82172af64dfd7520e8872352f6079f891a13d6e9a3eae1c1217db7d232c075a695857048052b65dbc06fc66b36354a09782ac50e1570009d194b9565fd
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD5aad5c94d8c18563f984d5bdf6c9b92f0
SHA16fb8bf3d805eee2de35ece2c91a0bc3259566787
SHA256494424e3fa5bb8ce39ca4fbc311348575be5ba0a5a25a10b77a0e72dfdccdbbd
SHA51270ff28e4a2aca9e5c9ec904f6203e7218e35a12e4ed3bb672823408d8f4e6e85dbf58f056320c03f2ae79f02057f660849db28d38e4c2f2910f385aac799f7c6
-
Filesize
72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57
-
Filesize
72KB
MD57dee65f6459ae1f4234c40a79072cb1c
SHA1df929857fe66f20230c5c4212202cb8182c1920d
SHA256dc52c8c6434269e50e532a4288e25ff9124f20250025b1cf0c872e9bcb569315
SHA51203f0f88f44fb67c7fe5ddb04f989389bc7006d12cfb50e3a9a36aec51cf2101d2f5c92fca2f55fd30a5742f9543cf4c637c137b33eebad99dd14e546c977fb57