Analysis
-
max time kernel
110s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 13:48
Static task
static1
Behavioral task
behavioral1
Sample
c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe
Resource
win10v2004-20221111-en
General
-
Target
c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe
-
Size
72KB
-
MD5
039047b418085e1143f6c96f6a64a58f
-
SHA1
2ed95fca3ec2b0673437d9750f84639acb333769
-
SHA256
c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6
-
SHA512
22df1a0407b48e874a0b3e18ea176fb29680af3a8f02cdf25c3d1439669d112cee0913e1858e7f8cfeda0138a6f526a5eb11336bf3600a79b78fd1dc06f99919
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2h:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrt
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1020 backup.exe 932 System Restore.exe 1096 backup.exe 1736 backup.exe 1908 backup.exe 1368 backup.exe 1760 backup.exe 1272 backup.exe 328 backup.exe 648 backup.exe 1928 backup.exe 272 backup.exe 1952 backup.exe 1380 backup.exe 1616 backup.exe 736 backup.exe 812 backup.exe 1900 backup.exe 1964 System Restore.exe 2020 backup.exe 1720 update.exe 1736 backup.exe 980 backup.exe 1960 backup.exe 1368 backup.exe 692 backup.exe 1104 backup.exe 1600 backup.exe 760 backup.exe 1296 backup.exe 1936 backup.exe 984 backup.exe 1912 backup.exe 1956 backup.exe 1884 backup.exe 1100 backup.exe 568 backup.exe 272 System Restore.exe 1140 backup.exe 2000 backup.exe 1320 backup.exe 952 backup.exe 1060 System Restore.exe 540 backup.exe 1692 backup.exe 2036 backup.exe 2004 backup.exe 2024 backup.exe 2016 backup.exe 1192 backup.exe 1908 backup.exe 1872 System Restore.exe 1980 backup.exe 1760 backup.exe 692 backup.exe 1432 backup.exe 1600 backup.exe 1136 data.exe 1644 update.exe 816 backup.exe 784 backup.exe 964 update.exe 1952 backup.exe 944 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1272 backup.exe 1272 backup.exe 328 backup.exe 328 backup.exe 1272 backup.exe 1272 backup.exe 1928 backup.exe 1928 backup.exe 272 backup.exe 272 backup.exe 1928 backup.exe 1928 backup.exe 1380 backup.exe 1380 backup.exe 1616 backup.exe 1616 backup.exe 1616 backup.exe 1616 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 1720 update.exe 1720 update.exe 1720 update.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 812 backup.exe 1272 backup.exe 1380 backup.exe 1380 backup.exe 1272 backup.exe 812 backup.exe 1616 backup.exe 1928 backup.exe 1616 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Policies\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\System Restore.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\System Restore.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe backup.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 1020 backup.exe 932 System Restore.exe 1096 backup.exe 1736 backup.exe 1908 backup.exe 1368 backup.exe 1760 backup.exe 1272 backup.exe 328 backup.exe 648 backup.exe 1928 backup.exe 272 backup.exe 1952 backup.exe 1380 backup.exe 1616 backup.exe 736 backup.exe 812 backup.exe 1900 backup.exe 1964 System Restore.exe 2020 backup.exe 1720 update.exe 1736 backup.exe 980 backup.exe 1960 backup.exe 1368 backup.exe 692 backup.exe 1104 backup.exe 1600 backup.exe 760 backup.exe 1296 backup.exe 1912 backup.exe 984 backup.exe 1936 backup.exe 1884 backup.exe 1956 backup.exe 1100 backup.exe 568 backup.exe 272 System Restore.exe 1320 backup.exe 2000 backup.exe 1140 backup.exe 1060 System Restore.exe 952 backup.exe 540 backup.exe 1692 backup.exe 2036 backup.exe 2024 backup.exe 2004 backup.exe 2016 backup.exe 1192 backup.exe 1872 System Restore.exe 1908 backup.exe 1980 backup.exe 1432 backup.exe 1760 backup.exe 692 backup.exe 1600 backup.exe 1136 data.exe 816 backup.exe 784 backup.exe 964 update.exe 1952 backup.exe 944 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1020 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 27 PID 1788 wrote to memory of 1020 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 27 PID 1788 wrote to memory of 1020 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 27 PID 1788 wrote to memory of 1020 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 27 PID 1788 wrote to memory of 932 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 28 PID 1788 wrote to memory of 932 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 28 PID 1788 wrote to memory of 932 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 28 PID 1788 wrote to memory of 932 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 28 PID 1788 wrote to memory of 1096 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 29 PID 1788 wrote to memory of 1096 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 29 PID 1788 wrote to memory of 1096 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 29 PID 1788 wrote to memory of 1096 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 29 PID 1788 wrote to memory of 1736 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 30 PID 1788 wrote to memory of 1736 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 30 PID 1788 wrote to memory of 1736 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 30 PID 1788 wrote to memory of 1736 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 30 PID 1788 wrote to memory of 1908 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 31 PID 1788 wrote to memory of 1908 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 31 PID 1788 wrote to memory of 1908 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 31 PID 1788 wrote to memory of 1908 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 31 PID 1788 wrote to memory of 1368 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 32 PID 1788 wrote to memory of 1368 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 32 PID 1788 wrote to memory of 1368 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 32 PID 1788 wrote to memory of 1368 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 32 PID 1788 wrote to memory of 1760 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 33 PID 1788 wrote to memory of 1760 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 33 PID 1788 wrote to memory of 1760 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 33 PID 1788 wrote to memory of 1760 1788 c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe 33 PID 1020 wrote to memory of 1272 1020 backup.exe 34 PID 1020 wrote to memory of 1272 1020 backup.exe 34 PID 1020 wrote to memory of 1272 1020 backup.exe 34 PID 1020 wrote to memory of 1272 1020 backup.exe 34 PID 1272 wrote to memory of 328 1272 backup.exe 35 PID 1272 wrote to memory of 328 1272 backup.exe 35 PID 1272 wrote to memory of 328 1272 backup.exe 35 PID 1272 wrote to memory of 328 1272 backup.exe 35 PID 328 wrote to memory of 648 328 backup.exe 36 PID 328 wrote to memory of 648 328 backup.exe 36 PID 328 wrote to memory of 648 328 backup.exe 36 PID 328 wrote to memory of 648 328 backup.exe 36 PID 1272 wrote to memory of 1928 1272 backup.exe 37 PID 1272 wrote to memory of 1928 1272 backup.exe 37 PID 1272 wrote to memory of 1928 1272 backup.exe 37 PID 1272 wrote to memory of 1928 1272 backup.exe 37 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 1928 wrote to memory of 272 1928 backup.exe 38 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 272 wrote to memory of 1952 272 backup.exe 39 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1928 wrote to memory of 1380 1928 backup.exe 40 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1380 wrote to memory of 1616 1380 backup.exe 41 PID 1616 wrote to memory of 736 1616 backup.exe 42 PID 1616 wrote to memory of 736 1616 backup.exe 42 PID 1616 wrote to memory of 736 1616 backup.exe 42 PID 1616 wrote to memory of 736 1616 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe"C:\Users\Admin\AppData\Local\Temp\c52bb87729f91ce55523df0f8dfad587b22aab45c9aa1d5bd24947bd1eab05d6.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2169744222\backup.exeC:\Users\Admin\AppData\Local\Temp\2169744222\backup.exe C:\Users\Admin\AppData\Local\Temp\2169744222\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1380 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1368
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2032
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
PID:896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1476
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
PID:972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- System policy modification
PID:1880
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1180
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:2152
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:984 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:272
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:540
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1152 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1504
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:732
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1368 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵PID:1572
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:364
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:512
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1044
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:1952
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Drops file in Program Files directory
PID:1708 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:240
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1832
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:2120
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:936
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:836
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1296
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1884 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1140
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2004 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1432
-
-
C:\Program Files\Common Files\System\ado\en-US\update.exe"C:\Program Files\Common Files\System\ado\en-US\update.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Executes dropped EXE
- System policy modification
PID:1644
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
PID:1916
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:816
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1908
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:1272
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
PID:936
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1872
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:944
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1972
-
-
C:\Program Files\Common Files\System\it-IT\System Restore.exe"C:\Program Files\Common Files\System\it-IT\System Restore.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:2044
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:584
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2136
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1100
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1320
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:952
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:1908
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:816
-
-
C:\Program Files\DVD Maker\Shared\data.exe"C:\Program Files\DVD Maker\Shared\data.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:584 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1892 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1976
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1824
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
PID:1040
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- System policy modification
PID:1820
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1992
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:1468
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
- System policy modification
PID:2028
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:692
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:468
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:2016
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:888
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:2104
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Drops file in Program Files directory
PID:1160 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:268 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:1976
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵PID:2176
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1092 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1888
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:2024
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1472
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1108
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2080
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1796
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1760
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1312
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2160
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:760 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1620
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:880 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1968
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2028
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Drops file in Program Files directory
PID:2020 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1816
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
PID:1880
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1184 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Drops file in Program Files directory
- System policy modification
PID:1940 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1820
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Disables RegEdit via registry modification
PID:1312 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:512
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵PID:1824
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:648
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:1632
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1764 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:1476
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1700
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1900
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Disables RegEdit via registry modification
PID:2008 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
PID:1808 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:1964
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1728
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:268
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:2088
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:2216
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:888 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:2000
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1748 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:364
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:968
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1336
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1504
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:2128
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1372 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Disables RegEdit via registry modification
PID:1576
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1596
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:1956
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:1904
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:2144
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
PID:664 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1296
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:2020
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1692 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:672
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1916
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1040
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1612
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2108
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5687e7fa42a620bc4eed22f05d4fa8dcf
SHA181998c9d731f491e5878c596c16d4a01dcd4d9f0
SHA256a06bc52bbae6806c2e11e712d8f81b5d8e1ab7bedcdcdeba4211759a31b0fea3
SHA512b32dff5089e9b04103c4566dd6d76296205af6c06cc2cc3431d8e170cbb66179bd1826a480eae3c559de3309ed2f956c79caec425ef8d1069677062f504fcde2
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD576667736ce4d363c66e5488447888411
SHA1a62caa2c9859fbd29f7e7ba03d28a990a48258e8
SHA256b93226cec3a8c2747d1d4b5b05473970bb9a4089656284315e919955d7b7fe93
SHA5125f239cabd510b37cba9aebf74fedd1afd8d98403731413599b3ea277e23953f7a9489c85152a1504d7f4a9735529090f70c10cb5f9ab524c14c0fc497cca4593
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD576667736ce4d363c66e5488447888411
SHA1a62caa2c9859fbd29f7e7ba03d28a990a48258e8
SHA256b93226cec3a8c2747d1d4b5b05473970bb9a4089656284315e919955d7b7fe93
SHA5125f239cabd510b37cba9aebf74fedd1afd8d98403731413599b3ea277e23953f7a9489c85152a1504d7f4a9735529090f70c10cb5f9ab524c14c0fc497cca4593
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD57e367d3f8573a58ffe1b982c953f9fe9
SHA1a3d53557e007791fd72bf43aac5ea334049fd0c3
SHA2568f6c0d3f22519f6595f6cd519a7fc353705421975c48a211cb6f43daacf1fbbf
SHA512ee2e232d7577ea365ac9cdbae1c37f64d8624a512c9120e55eea6609b14bc404713784419d06aa181c055d0f93002abfedf6994a014c8e59d2eb7f25bfb9637a
-
Filesize
72KB
MD57e367d3f8573a58ffe1b982c953f9fe9
SHA1a3d53557e007791fd72bf43aac5ea334049fd0c3
SHA2568f6c0d3f22519f6595f6cd519a7fc353705421975c48a211cb6f43daacf1fbbf
SHA512ee2e232d7577ea365ac9cdbae1c37f64d8624a512c9120e55eea6609b14bc404713784419d06aa181c055d0f93002abfedf6994a014c8e59d2eb7f25bfb9637a
-
Filesize
72KB
MD5687e7fa42a620bc4eed22f05d4fa8dcf
SHA181998c9d731f491e5878c596c16d4a01dcd4d9f0
SHA256a06bc52bbae6806c2e11e712d8f81b5d8e1ab7bedcdcdeba4211759a31b0fea3
SHA512b32dff5089e9b04103c4566dd6d76296205af6c06cc2cc3431d8e170cbb66179bd1826a480eae3c559de3309ed2f956c79caec425ef8d1069677062f504fcde2
-
Filesize
72KB
MD5687e7fa42a620bc4eed22f05d4fa8dcf
SHA181998c9d731f491e5878c596c16d4a01dcd4d9f0
SHA256a06bc52bbae6806c2e11e712d8f81b5d8e1ab7bedcdcdeba4211759a31b0fea3
SHA512b32dff5089e9b04103c4566dd6d76296205af6c06cc2cc3431d8e170cbb66179bd1826a480eae3c559de3309ed2f956c79caec425ef8d1069677062f504fcde2
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD5524743fe804792260111c9663ee45dc3
SHA1d148752153b4c3da893ab0ee3b42471b805138c6
SHA2566087fc968ab132f2a5f36bca2dcd99e6e7c38128c0d8efced39c44ab9361e584
SHA5120088190de3717e574d01490b414ae8285a3a12537055fdaf066a00b53118d370630a277660c1ab225a3608f5fc5c18585ebf107cc53f912bd6d9fd5b0ce81d27
-
Filesize
72KB
MD576667736ce4d363c66e5488447888411
SHA1a62caa2c9859fbd29f7e7ba03d28a990a48258e8
SHA256b93226cec3a8c2747d1d4b5b05473970bb9a4089656284315e919955d7b7fe93
SHA5125f239cabd510b37cba9aebf74fedd1afd8d98403731413599b3ea277e23953f7a9489c85152a1504d7f4a9735529090f70c10cb5f9ab524c14c0fc497cca4593
-
Filesize
72KB
MD576667736ce4d363c66e5488447888411
SHA1a62caa2c9859fbd29f7e7ba03d28a990a48258e8
SHA256b93226cec3a8c2747d1d4b5b05473970bb9a4089656284315e919955d7b7fe93
SHA5125f239cabd510b37cba9aebf74fedd1afd8d98403731413599b3ea277e23953f7a9489c85152a1504d7f4a9735529090f70c10cb5f9ab524c14c0fc497cca4593
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD586d17b2eae58bf2da11e59ce8815a938
SHA1aaeea2bcb8d5756dfafabbb259f3f8792f14a5ce
SHA25620a9a43ec98e088e54d5df3819580759afa32380cea1926daeebc5ae0af6b7d5
SHA51210d58bafe6c0e06c16801d9c2f1698643e7f6d9834e18c3221e6a9bf46dd0b0e5d0aea9145dea0fcdd498f2b0aefbb2722f2f4d69fd42d2be3317be70057e454
-
Filesize
72KB
MD576667736ce4d363c66e5488447888411
SHA1a62caa2c9859fbd29f7e7ba03d28a990a48258e8
SHA256b93226cec3a8c2747d1d4b5b05473970bb9a4089656284315e919955d7b7fe93
SHA5125f239cabd510b37cba9aebf74fedd1afd8d98403731413599b3ea277e23953f7a9489c85152a1504d7f4a9735529090f70c10cb5f9ab524c14c0fc497cca4593
-
Filesize
72KB
MD576667736ce4d363c66e5488447888411
SHA1a62caa2c9859fbd29f7e7ba03d28a990a48258e8
SHA256b93226cec3a8c2747d1d4b5b05473970bb9a4089656284315e919955d7b7fe93
SHA5125f239cabd510b37cba9aebf74fedd1afd8d98403731413599b3ea277e23953f7a9489c85152a1504d7f4a9735529090f70c10cb5f9ab524c14c0fc497cca4593
-
Filesize
72KB
MD5657177c5c7eb11619d875b033f4d9239
SHA1516664403f55e1a0e0f81c381096f655ac23f3a5
SHA256d7ed80655d9f058ed40c8551564643ef58d8bb56a4f247bad0fc2db329e116db
SHA512590f48b22f1190905261e298d98dccaec4a50596fff3e1f1cd6edd4dda8ccb12b08e88fa1412967d1325fde0664b15537810495362ab1fc4ec914e7bb74ab1bf
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD56297bea4d6c95ee17823b929f37be15e
SHA18075390ed9f2ce732da2845610bec4924c50cc7f
SHA256b679b8fe7509932026da222de790bc69e454eccc76b0595ee42e700fee09211c
SHA512129ff8c9d24f8f5421d584ca201abc54e1890a64c6edb96e1a68b4d6e7b1f343ddaed9cabe7f67417f03310075459f003a37afe073d20b873b7f45f5a731d5dc
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD51c2beb51b25bfec9edace8b202c7ca22
SHA170498f51d68960a5fb095efbc6b4e7a7746fd993
SHA256b314a7adc3772c7829cb22eb1b23edbe68f6da441cfe3d2940eace9e8541d7e5
SHA51242da97ade46af4e7bbe93ae631fac2baafe4a7bec67d5d4ed8ec41773759ec2f56e8178fa6e2a388aace1e5f930901f1bc430f1ba113016417c7a2c2a5c6baf7
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD58e475e7012c25b9e6b18efce8410fdf9
SHA196b09bf8af2bff9ff4a7b979e573ddd6656a5aac
SHA256dbbe87c439ebdbaef3eada5e8fb4d0ef9e4579c55159b4fa124f3ad490411d01
SHA5128d6d636f70e404bfeda692d1a37d7280bcaca76aac8b844f9e0fe20656b4b63b53005e3d518751044206b3982a7836c1b3472b7d94b163a0f66a1f820fe04a10
-
Filesize
72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7
-
Filesize
72KB
MD52554ee2b8e8e92ce97e1c7d8257db1d5
SHA1f122a8fe2e752b819b85672d8804462688f918b9
SHA256a7229fd6fecc79ed7abc99483777365de667c3017e9ab26fe675910a8b4c6c03
SHA51299239ba02ca285a2dd6ca4a9e7820a2e67fbb7e4d1aab240efeae7abfac7a6d28a5522f74f9dc2d546c34f4d993832eee02fe213321380044616565abb477ac7