Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe
Resource
win10v2004-20220901-en
General
-
Target
d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe
-
Size
72KB
-
MD5
0a32eedf4bce86003f384ed3f8f06891
-
SHA1
29eb2b17ae55fe68229b5c74a8b74704e8da1ad3
-
SHA256
d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac
-
SHA512
0a74884def47123e713192fa59551cdda7a5ec3e58fb93b1fcbf03075bbcf1c81051a7f26a16a36c50d8e1293bca3c0a7670153fbc4f2ba296873a0a55215554
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf29:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPJ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 976 backup.exe 612 backup.exe 836 backup.exe 1200 backup.exe 548 backup.exe 1468 update.exe 440 backup.exe 1828 backup.exe 572 backup.exe 1512 backup.exe 1712 data.exe 1760 backup.exe 1084 backup.exe 2012 backup.exe 1740 backup.exe 1752 backup.exe 936 backup.exe 1472 backup.exe 1080 backup.exe 2044 backup.exe 660 backup.exe 760 backup.exe 1692 backup.exe 1488 backup.exe 1468 backup.exe 1548 backup.exe 552 backup.exe 1496 backup.exe 1572 backup.exe 1704 backup.exe 968 data.exe 684 update.exe 1040 backup.exe 1680 backup.exe 2016 backup.exe 1400 backup.exe 1056 backup.exe 1084 backup.exe 276 backup.exe 1136 backup.exe 1916 backup.exe 852 backup.exe 956 backup.exe 1108 backup.exe 1452 backup.exe 1200 backup.exe 964 backup.exe 1132 backup.exe 520 backup.exe 1484 update.exe 1476 backup.exe 108 backup.exe 540 backup.exe 552 backup.exe 1596 backup.exe 1496 backup.exe 676 backup.exe 1988 backup.exe 1624 update.exe 1620 backup.exe 1352 backup.exe 288 data.exe 1908 backup.exe 1952 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1468 update.exe 1468 update.exe 1468 update.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 1828 backup.exe 1828 backup.exe 572 backup.exe 572 backup.exe 1828 backup.exe 1828 backup.exe 1712 data.exe 1712 data.exe 1760 backup.exe 1760 backup.exe 1712 data.exe 1712 data.exe 2012 backup.exe 2012 backup.exe 1740 backup.exe 1740 backup.exe 1740 backup.exe 1740 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 1572 backup.exe 1572 backup.exe 1572 backup.exe 1572 backup.exe 1572 backup.exe 684 update.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 976 backup.exe 612 backup.exe 836 backup.exe 1200 backup.exe 548 backup.exe 1468 update.exe 440 backup.exe 1828 backup.exe 572 backup.exe 1512 backup.exe 1712 data.exe 1760 backup.exe 1084 backup.exe 2012 backup.exe 1740 backup.exe 1752 backup.exe 936 backup.exe 1472 backup.exe 1080 backup.exe 2044 backup.exe 660 backup.exe 760 backup.exe 1692 backup.exe 1488 backup.exe 1468 backup.exe 1548 backup.exe 552 backup.exe 1496 backup.exe 1572 backup.exe 1704 backup.exe 968 data.exe 684 update.exe 1040 backup.exe 1680 backup.exe 2016 backup.exe 1400 backup.exe 1056 backup.exe 1084 backup.exe 276 backup.exe 1136 backup.exe 956 backup.exe 1108 backup.exe 1916 backup.exe 1452 backup.exe 852 backup.exe 1200 backup.exe 964 backup.exe 1476 backup.exe 1132 backup.exe 520 backup.exe 1484 update.exe 108 backup.exe 540 backup.exe 552 backup.exe 1496 backup.exe 1596 backup.exe 676 backup.exe 1988 backup.exe 1352 backup.exe 1620 backup.exe 288 data.exe 1908 backup.exe 1952 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 976 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 28 PID 1968 wrote to memory of 976 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 28 PID 1968 wrote to memory of 976 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 28 PID 1968 wrote to memory of 976 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 28 PID 1968 wrote to memory of 612 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 29 PID 1968 wrote to memory of 612 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 29 PID 1968 wrote to memory of 612 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 29 PID 1968 wrote to memory of 612 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 29 PID 1968 wrote to memory of 836 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 30 PID 1968 wrote to memory of 836 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 30 PID 1968 wrote to memory of 836 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 30 PID 1968 wrote to memory of 836 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 30 PID 1968 wrote to memory of 1200 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 31 PID 1968 wrote to memory of 1200 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 31 PID 1968 wrote to memory of 1200 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 31 PID 1968 wrote to memory of 1200 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 31 PID 1968 wrote to memory of 548 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 32 PID 1968 wrote to memory of 548 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 32 PID 1968 wrote to memory of 548 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 32 PID 1968 wrote to memory of 548 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 32 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 1468 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 33 PID 1968 wrote to memory of 440 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 34 PID 1968 wrote to memory of 440 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 34 PID 1968 wrote to memory of 440 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 34 PID 1968 wrote to memory of 440 1968 d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe 34 PID 976 wrote to memory of 1828 976 backup.exe 35 PID 976 wrote to memory of 1828 976 backup.exe 35 PID 976 wrote to memory of 1828 976 backup.exe 35 PID 976 wrote to memory of 1828 976 backup.exe 35 PID 1828 wrote to memory of 572 1828 backup.exe 36 PID 1828 wrote to memory of 572 1828 backup.exe 36 PID 1828 wrote to memory of 572 1828 backup.exe 36 PID 1828 wrote to memory of 572 1828 backup.exe 36 PID 572 wrote to memory of 1512 572 backup.exe 37 PID 572 wrote to memory of 1512 572 backup.exe 37 PID 572 wrote to memory of 1512 572 backup.exe 37 PID 572 wrote to memory of 1512 572 backup.exe 37 PID 1828 wrote to memory of 1712 1828 backup.exe 38 PID 1828 wrote to memory of 1712 1828 backup.exe 38 PID 1828 wrote to memory of 1712 1828 backup.exe 38 PID 1828 wrote to memory of 1712 1828 backup.exe 38 PID 1712 wrote to memory of 1760 1712 data.exe 39 PID 1712 wrote to memory of 1760 1712 data.exe 39 PID 1712 wrote to memory of 1760 1712 data.exe 39 PID 1712 wrote to memory of 1760 1712 data.exe 39 PID 1760 wrote to memory of 1084 1760 backup.exe 40 PID 1760 wrote to memory of 1084 1760 backup.exe 40 PID 1760 wrote to memory of 1084 1760 backup.exe 40 PID 1760 wrote to memory of 1084 1760 backup.exe 40 PID 1712 wrote to memory of 2012 1712 data.exe 41 PID 1712 wrote to memory of 2012 1712 data.exe 41 PID 1712 wrote to memory of 2012 1712 data.exe 41 PID 1712 wrote to memory of 2012 1712 data.exe 41 PID 2012 wrote to memory of 1740 2012 backup.exe 42 PID 2012 wrote to memory of 1740 2012 backup.exe 42 PID 2012 wrote to memory of 1740 2012 backup.exe 42 PID 2012 wrote to memory of 1740 2012 backup.exe 42 PID 1740 wrote to memory of 1752 1740 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe"C:\Users\Admin\AppData\Local\Temp\d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\1652623185\backup.exeC:\Users\Admin\AppData\Local\Temp\1652623185\backup.exe C:\Users\Admin\AppData\Local\Temp\1652623185\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1828 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1512
-
-
-
C:\Program Files\data.exe"C:\Program Files\data.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1084
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:936 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:660
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1488
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1400
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1056
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:276
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1452
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:288
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1820
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1312
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:1252
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:812
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1548
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵PID:1328
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1108 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:964
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:108
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:676
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1396
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1336 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1352
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:756
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2060
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1476
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:540 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1988 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1600
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1192
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:760
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:596
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
PID:676
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1480
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:788
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1624
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:744
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:672
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1076
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1916 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496
-
-
C:\Program Files\DVD Maker\es-ES\update.exe"C:\Program Files\DVD Maker\es-ES\update.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:1624
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:956
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1212
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
PID:1084
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1488
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:2112
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:964
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1204 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1880
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:892
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1044
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1700
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1696
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1200
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1600
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Program Files (x86)\Adobe\update.exe"C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1596 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1620
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
- System policy modification
PID:1748 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1076
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:1548
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1196
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1336
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:676
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:548
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1648
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1988
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:832
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1640 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:904
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\update.exe"C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:840
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1620
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1052
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1952
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:1156
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1540 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:940
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1920
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1616
-
-
C:\Program Files (x86)\Google\Update\update.exe"C:\Program Files (x86)\Google\Update\update.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1040
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:956
-
-
C:\Program Files (x86)\Microsoft Sync Framework\data.exe"C:\Program Files (x86)\Microsoft Sync Framework\data.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2052
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:556
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1680
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1500
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:2072
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:612
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1468
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:440
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD504f3b7b31cc142da15d3c404420c9273
SHA116f62cddbc14a4bdc2c30f281231f12155f5d111
SHA25688f07427774c6221467455b0e106af20789eb2d47a2038e8c975070cecf51bf2
SHA512c8753b3709900a50964ed10df2acd855830faad667a9d11d37a0dfcf99fea2292fd4e639914a155be22e6ca4a50d52ae638c3aec7df289ece3a8c1998cb5b888
-
Filesize
72KB
MD58cbf8832d7a2092a57b24aae3fab71e6
SHA1c40f9abf7baa72282cba6db4400b24578ece0d13
SHA256e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8
SHA512f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54
-
Filesize
72KB
MD58cbf8832d7a2092a57b24aae3fab71e6
SHA1c40f9abf7baa72282cba6db4400b24578ece0d13
SHA256e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8
SHA512f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD53da98d246240f88eaa64aae85346f07e
SHA1eda2c6e84500fbff08b8121a2338af86ee71df31
SHA256710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7
SHA51253d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5e254fb54f8b29789b0deb8d7339fca79
SHA17900422743ef472adb0f870056744c0ec746f21e
SHA2568a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c
SHA5122c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8
-
Filesize
72KB
MD5e254fb54f8b29789b0deb8d7339fca79
SHA17900422743ef472adb0f870056744c0ec746f21e
SHA2568a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c
SHA5122c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD56101a3014d817bd2c7278eccacfd4f02
SHA1bce4155f7adb7cb999e50526eb69491a5133c41e
SHA256c8a7422e963e69e18ca2fa47a2d2814da341b8a4e92ffbea8f108e6adec853f7
SHA5121900f5c235ff7b06b45a1c00c431971d6333c3baaffd8151933bd93f28d24b1c2faae6223e359942715a13dfff08af10125fc8796db744e037ccfb4dc25aa404
-
Filesize
72KB
MD56101a3014d817bd2c7278eccacfd4f02
SHA1bce4155f7adb7cb999e50526eb69491a5133c41e
SHA256c8a7422e963e69e18ca2fa47a2d2814da341b8a4e92ffbea8f108e6adec853f7
SHA5121900f5c235ff7b06b45a1c00c431971d6333c3baaffd8151933bd93f28d24b1c2faae6223e359942715a13dfff08af10125fc8796db744e037ccfb4dc25aa404
-
Filesize
72KB
MD504f3b7b31cc142da15d3c404420c9273
SHA116f62cddbc14a4bdc2c30f281231f12155f5d111
SHA25688f07427774c6221467455b0e106af20789eb2d47a2038e8c975070cecf51bf2
SHA512c8753b3709900a50964ed10df2acd855830faad667a9d11d37a0dfcf99fea2292fd4e639914a155be22e6ca4a50d52ae638c3aec7df289ece3a8c1998cb5b888
-
Filesize
72KB
MD504f3b7b31cc142da15d3c404420c9273
SHA116f62cddbc14a4bdc2c30f281231f12155f5d111
SHA25688f07427774c6221467455b0e106af20789eb2d47a2038e8c975070cecf51bf2
SHA512c8753b3709900a50964ed10df2acd855830faad667a9d11d37a0dfcf99fea2292fd4e639914a155be22e6ca4a50d52ae638c3aec7df289ece3a8c1998cb5b888
-
Filesize
72KB
MD58cbf8832d7a2092a57b24aae3fab71e6
SHA1c40f9abf7baa72282cba6db4400b24578ece0d13
SHA256e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8
SHA512f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54
-
Filesize
72KB
MD58cbf8832d7a2092a57b24aae3fab71e6
SHA1c40f9abf7baa72282cba6db4400b24578ece0d13
SHA256e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8
SHA512f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD558415da1e9bc15926282176bcf03a635
SHA10cff7f45af099f24ede9de788d7db33f4c0f4ee3
SHA25653e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c
SHA5126f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32
-
Filesize
72KB
MD53da98d246240f88eaa64aae85346f07e
SHA1eda2c6e84500fbff08b8121a2338af86ee71df31
SHA256710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7
SHA51253d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2
-
Filesize
72KB
MD53da98d246240f88eaa64aae85346f07e
SHA1eda2c6e84500fbff08b8121a2338af86ee71df31
SHA256710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7
SHA51253d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD5eb18045a9becfa2a8219c51ba66cf9f8
SHA1b98970c869ffd903114580ca9dd4cc4483ce7225
SHA2566d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310
SHA5129e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb
-
Filesize
72KB
MD53da98d246240f88eaa64aae85346f07e
SHA1eda2c6e84500fbff08b8121a2338af86ee71df31
SHA256710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7
SHA51253d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5bc2db97578217c5d242af3b1ca19e6c0
SHA168daf8714371dbb191eb0fb0c7d1405b154501a1
SHA2568bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9
SHA512a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34
-
Filesize
72KB
MD5e254fb54f8b29789b0deb8d7339fca79
SHA17900422743ef472adb0f870056744c0ec746f21e
SHA2568a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c
SHA5122c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8
-
Filesize
72KB
MD5e254fb54f8b29789b0deb8d7339fca79
SHA17900422743ef472adb0f870056744c0ec746f21e
SHA2568a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c
SHA5122c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD59c2afbb71c0216fde34b4c671252e6a8
SHA138472515c7f83317737f4a9cadbf9fcd02d2e6f6
SHA256ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f
SHA5126e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25
-
Filesize
72KB
MD55ea8c83f2d9c248e84fede3924b4d22e
SHA1e429a6e9414319613ed1821b9fd1bcaf53058663
SHA2568b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51
SHA51229c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25