Analysis
-
max time kernel
201s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 14:21 UTC
Static task
static1
Behavioral task
behavioral1
Sample
8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe
Resource
win10v2004-20220812-en
General
-
Target
8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe
-
Size
72KB
-
MD5
11099deb0c163459ae1b42709ae56081
-
SHA1
527f920ad7a37f678b1580721a3a352dbd5ccb2d
-
SHA256
8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5
-
SHA512
473d57b3844e1f6f64743934cdf4b065be0cefeb31677d4c69d721bea3e0ae1ceb52ddf615abe18869547bee7fc74c35f590d64d1f6237e5063d0d5d9edecb50
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2p:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP9
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2040 backup.exe 1060 backup.exe 1104 backup.exe 268 backup.exe 2044 backup.exe 1444 backup.exe 1492 backup.exe 1612 backup.exe 1660 backup.exe 1972 backup.exe 1016 backup.exe 1992 backup.exe 852 backup.exe 276 backup.exe 1820 backup.exe 1536 backup.exe 864 backup.exe 1460 backup.exe 844 backup.exe 688 backup.exe 1176 backup.exe 1508 backup.exe 1680 backup.exe 764 backup.exe 2044 update.exe 1856 backup.exe 1620 backup.exe 1312 backup.exe 1580 backup.exe 1264 backup.exe 240 backup.exe 968 backup.exe 300 backup.exe 1616 backup.exe 1068 backup.exe 1780 backup.exe 1532 backup.exe 1432 backup.exe 1648 backup.exe 552 backup.exe 692 backup.exe 1480 backup.exe 1720 backup.exe 1828 System Restore.exe 1568 System Restore.exe 528 backup.exe 1060 backup.exe 1876 backup.exe 1408 backup.exe 572 System Restore.exe 1116 data.exe 764 backup.exe 1696 backup.exe 1356 backup.exe 1004 data.exe 800 backup.exe 992 backup.exe 1904 backup.exe 1540 backup.exe 1232 backup.exe 1888 backup.exe 1324 data.exe 1432 data.exe 1592 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 1492 backup.exe 1492 backup.exe 1660 backup.exe 1660 backup.exe 1492 backup.exe 1492 backup.exe 1016 backup.exe 1016 backup.exe 1992 backup.exe 1992 backup.exe 1016 backup.exe 1016 backup.exe 276 backup.exe 276 backup.exe 1820 backup.exe 1820 backup.exe 1820 backup.exe 1820 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 2044 update.exe 2044 update.exe 2044 update.exe 864 backup.exe 864 backup.exe 864 backup.exe 864 backup.exe 1492 backup.exe 1492 backup.exe 864 backup.exe 276 backup.exe 864 backup.exe 276 backup.exe 1820 backup.exe 1016 backup.exe 1820 backup.exe 1016 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 2040 backup.exe 1060 backup.exe 1104 backup.exe 268 backup.exe 2044 backup.exe 1444 backup.exe 1492 backup.exe 1612 backup.exe 1660 backup.exe 1972 backup.exe 1016 backup.exe 1992 backup.exe 852 backup.exe 276 backup.exe 1820 backup.exe 1536 backup.exe 864 backup.exe 1460 backup.exe 844 backup.exe 688 backup.exe 1176 backup.exe 1508 backup.exe 1680 backup.exe 764 backup.exe 2044 update.exe 1856 backup.exe 1620 backup.exe 1312 backup.exe 1580 backup.exe 1264 backup.exe 240 backup.exe 968 backup.exe 300 backup.exe 1068 backup.exe 1532 backup.exe 1616 backup.exe 1780 backup.exe 1432 backup.exe 552 backup.exe 1648 backup.exe 1480 backup.exe 1828 System Restore.exe 1720 backup.exe 692 backup.exe 1568 System Restore.exe 528 backup.exe 1408 backup.exe 1060 backup.exe 572 System Restore.exe 1876 backup.exe 764 backup.exe 1116 data.exe 1696 backup.exe 992 backup.exe 1356 backup.exe 1004 data.exe 800 backup.exe 1904 backup.exe 1232 backup.exe 1540 backup.exe 1888 backup.exe 1592 backup.exe 1612 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2040 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 28 PID 1228 wrote to memory of 2040 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 28 PID 1228 wrote to memory of 2040 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 28 PID 1228 wrote to memory of 2040 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 28 PID 1228 wrote to memory of 1060 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 29 PID 1228 wrote to memory of 1060 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 29 PID 1228 wrote to memory of 1060 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 29 PID 1228 wrote to memory of 1060 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 29 PID 1228 wrote to memory of 1104 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 30 PID 1228 wrote to memory of 1104 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 30 PID 1228 wrote to memory of 1104 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 30 PID 1228 wrote to memory of 1104 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 30 PID 1228 wrote to memory of 268 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 31 PID 1228 wrote to memory of 268 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 31 PID 1228 wrote to memory of 268 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 31 PID 1228 wrote to memory of 268 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 31 PID 1228 wrote to memory of 2044 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 32 PID 1228 wrote to memory of 2044 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 32 PID 1228 wrote to memory of 2044 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 32 PID 1228 wrote to memory of 2044 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 32 PID 1228 wrote to memory of 1444 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 33 PID 1228 wrote to memory of 1444 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 33 PID 1228 wrote to memory of 1444 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 33 PID 1228 wrote to memory of 1444 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 33 PID 2040 wrote to memory of 1492 2040 backup.exe 34 PID 2040 wrote to memory of 1492 2040 backup.exe 34 PID 2040 wrote to memory of 1492 2040 backup.exe 34 PID 2040 wrote to memory of 1492 2040 backup.exe 34 PID 1228 wrote to memory of 1612 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 36 PID 1228 wrote to memory of 1612 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 36 PID 1228 wrote to memory of 1612 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 36 PID 1228 wrote to memory of 1612 1228 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe 36 PID 1492 wrote to memory of 1660 1492 backup.exe 35 PID 1492 wrote to memory of 1660 1492 backup.exe 35 PID 1492 wrote to memory of 1660 1492 backup.exe 35 PID 1492 wrote to memory of 1660 1492 backup.exe 35 PID 1660 wrote to memory of 1972 1660 backup.exe 37 PID 1660 wrote to memory of 1972 1660 backup.exe 37 PID 1660 wrote to memory of 1972 1660 backup.exe 37 PID 1660 wrote to memory of 1972 1660 backup.exe 37 PID 1492 wrote to memory of 1016 1492 backup.exe 38 PID 1492 wrote to memory of 1016 1492 backup.exe 38 PID 1492 wrote to memory of 1016 1492 backup.exe 38 PID 1492 wrote to memory of 1016 1492 backup.exe 38 PID 1016 wrote to memory of 1992 1016 backup.exe 39 PID 1016 wrote to memory of 1992 1016 backup.exe 39 PID 1016 wrote to memory of 1992 1016 backup.exe 39 PID 1016 wrote to memory of 1992 1016 backup.exe 39 PID 1992 wrote to memory of 852 1992 backup.exe 40 PID 1992 wrote to memory of 852 1992 backup.exe 40 PID 1992 wrote to memory of 852 1992 backup.exe 40 PID 1992 wrote to memory of 852 1992 backup.exe 40 PID 1016 wrote to memory of 276 1016 backup.exe 41 PID 1016 wrote to memory of 276 1016 backup.exe 41 PID 1016 wrote to memory of 276 1016 backup.exe 41 PID 1016 wrote to memory of 276 1016 backup.exe 41 PID 276 wrote to memory of 1820 276 backup.exe 42 PID 276 wrote to memory of 1820 276 backup.exe 42 PID 276 wrote to memory of 1820 276 backup.exe 42 PID 276 wrote to memory of 1820 276 backup.exe 42 PID 1820 wrote to memory of 1536 1820 backup.exe 43 PID 1820 wrote to memory of 1536 1820 backup.exe 43 PID 1820 wrote to memory of 1536 1820 backup.exe 43 PID 1820 wrote to memory of 1536 1820 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe"C:\Users\Admin\AppData\Local\Temp\8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3509248515\backup.exeC:\Users\Admin\AppData\Local\Temp\3509248515\backup.exe C:\Users\Admin\AppData\Local\Temp\3509248515\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1492 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1660 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:852
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:276 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1820 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:864 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1460
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1508
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:848
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:1972
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1344
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:2232
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:240 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1432
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1296
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1780 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1828
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1232
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:896 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1264
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:2176
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:824
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1856
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2200
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1264
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1568
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:764 -
C:\Program Files\Common Files\System\ado\data.exe"C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
PID:1432 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1900
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1060
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1968
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:2052
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:2168
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:964
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1688
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1976
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:2152
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:968 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552
-
-
C:\Program Files\DVD Maker\en-US\System Restore.exe"C:\Program Files\DVD Maker\en-US\System Restore.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:572
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1356
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:1612
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1700
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1684
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:2044
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1700
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1068 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:528 -
C:\Program Files\Google\Chrome\Application\data.exe"C:\Program Files\Google\Chrome\Application\data.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1004 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1888 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- System policy modification
PID:1780
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:300
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:2284
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1236
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1924
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1720
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1896
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:2184
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1312 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:692 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:1324
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1596 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1132
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:1676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1880
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:2060
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:2144
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1200
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2084
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:188
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:688
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:980
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:572
-
-
C:\Program Files (x86)\Microsoft Analysis Services\data.exe"C:\Program Files (x86)\Microsoft Analysis Services\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2192
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:300 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:800
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:552
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:1588
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:1172
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:1964
-
-
C:\Users\Admin\Pictures\update.exeC:\Users\Admin\Pictures\update.exe C:\Users\Admin\Pictures\6⤵PID:1504
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:2160
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:828
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1480
-
-
C:\Users\Public\Downloads\data.exeC:\Users\Public\Downloads\data.exe C:\Users\Public\Downloads\6⤵PID:2092
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:2276
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1564
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:552
-
-
C:\Windows\AppCompat\data.exeC:\Windows\AppCompat\data.exe C:\Windows\AppCompat\5⤵PID:2100
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:2268
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5d015a4271e191dd69ffe7a64a65b7ab0
SHA12c0429f0a50ffc9cbc6b63a7af9f854fd4dfa664
SHA2564f07597e84a32098c05d2954d51c8f6dd342f806e7d98040b8679e02dd5afeb2
SHA5127b98c9fb20b07966d50c7bb292b3af1ca39ef84a7fe9c73599f384438f2d873fbf1d3efde23e17bed3e406d20bdffc51c31facdbe6910ea6641e98af22237fc1
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD59f0c9c0cb4fbc11cc7a8f6cec4c66846
SHA15b11465e3a692b4fdb60f7235785f062128164b5
SHA256fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87
SHA51235037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD59f0c9c0cb4fbc11cc7a8f6cec4c66846
SHA15b11465e3a692b4fdb60f7235785f062128164b5
SHA256fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87
SHA51235037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24
-
Filesize
72KB
MD530325186962915ae26e4a5751b500c4e
SHA1ab82304e3d4cdf21bc5eb739c26fd7c4972550dc
SHA256f428a19e91f48ca8ae3dc879bc47f8860cbc4f91e8e60e89a7e26d0d08ea8209
SHA512d115a94c6365bcc0b611933cb034d9f4550c01d020a023df282209de7e6f53c7a05b3d3fac232387a7e15c9295b20dc2fde064f6e90a9f35768feaac5b13bc82
-
Filesize
72KB
MD530325186962915ae26e4a5751b500c4e
SHA1ab82304e3d4cdf21bc5eb739c26fd7c4972550dc
SHA256f428a19e91f48ca8ae3dc879bc47f8860cbc4f91e8e60e89a7e26d0d08ea8209
SHA512d115a94c6365bcc0b611933cb034d9f4550c01d020a023df282209de7e6f53c7a05b3d3fac232387a7e15c9295b20dc2fde064f6e90a9f35768feaac5b13bc82
-
Filesize
72KB
MD5d015a4271e191dd69ffe7a64a65b7ab0
SHA12c0429f0a50ffc9cbc6b63a7af9f854fd4dfa664
SHA2564f07597e84a32098c05d2954d51c8f6dd342f806e7d98040b8679e02dd5afeb2
SHA5127b98c9fb20b07966d50c7bb292b3af1ca39ef84a7fe9c73599f384438f2d873fbf1d3efde23e17bed3e406d20bdffc51c31facdbe6910ea6641e98af22237fc1
-
Filesize
72KB
MD5d015a4271e191dd69ffe7a64a65b7ab0
SHA12c0429f0a50ffc9cbc6b63a7af9f854fd4dfa664
SHA2564f07597e84a32098c05d2954d51c8f6dd342f806e7d98040b8679e02dd5afeb2
SHA5127b98c9fb20b07966d50c7bb292b3af1ca39ef84a7fe9c73599f384438f2d873fbf1d3efde23e17bed3e406d20bdffc51c31facdbe6910ea6641e98af22237fc1
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD5887540c682547c59ae0752868cc5fa37
SHA1259a46b60d65ac5a0e17ec5fac2b748ab1578827
SHA256644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762
SHA512f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD536cfd7e25c5b7bba1ba0058447813ebb
SHA1ad2bf8960efe9d006d59d37359f4437ae9171990
SHA256befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf
SHA51269de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD575b3e35b7a2dd159dfdaf2ac19af21c2
SHA194aa1fbb19d4d46c768fd1b6fe466793cf9ebea9
SHA25699043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34
SHA512d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD5a60c1b1c6f5bdcd2f20d506dd4de6a46
SHA1c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46
SHA25665251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862
SHA51253618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD58668839eb7ed7f5d623769c0563ba33d
SHA119a21586307a2e4b44673424bfddd32d43350413
SHA256ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9
SHA512157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD59f0c9c0cb4fbc11cc7a8f6cec4c66846
SHA15b11465e3a692b4fdb60f7235785f062128164b5
SHA256fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87
SHA51235037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24
-
Filesize
72KB
MD59f0c9c0cb4fbc11cc7a8f6cec4c66846
SHA15b11465e3a692b4fdb60f7235785f062128164b5
SHA256fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87
SHA51235037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD5b966893952dc99b635b8b240beb77a3b
SHA11024cf59d6028f9349b3363bff78bd66dd5c6f88
SHA256190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24
SHA512f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5
-
Filesize
72KB
MD59f0c9c0cb4fbc11cc7a8f6cec4c66846
SHA15b11465e3a692b4fdb60f7235785f062128164b5
SHA256fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87
SHA51235037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24
-
Filesize
72KB
MD59f0c9c0cb4fbc11cc7a8f6cec4c66846
SHA15b11465e3a692b4fdb60f7235785f062128164b5
SHA256fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87
SHA51235037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24