96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b

Analysis

max time kernel
152s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
Size

72KB
MD5

04bb6564646c44dfcb430a9dfa94a0b2
SHA1

96eafe0e762635bb4202f7b508bb6b8fae0777ba
SHA256

96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b
SHA512

6429c5a6c80b86b60307087101a90bb37e989167254ac3409be73c64eb23473ec53259cced4f0935968ba439ea58457d2e1d33be14c0f2c80b9b903fc9aae973
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2U:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPg

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 64 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 64 IoCs

pid	Process
1116	backup.exe
592	backup.exe
588	backup.exe
640	backup.exe
1536	backup.exe
1548	backup.exe
540	data.exe
868	System Restore.exe
836	backup.exe
1752	backup.exe
1512	backup.exe
1872	backup.exe
1876	backup.exe
1540	backup.exe
1416	backup.exe
2024	backup.exe
896	backup.exe
1768	backup.exe
1604	backup.exe
608	backup.exe
1476	System Restore.exe
920	backup.exe
900	backup.exe
1716	System Restore.exe
664	data.exe
1776	backup.exe
1060	backup.exe
852	System Restore.exe
1996	System Restore.exe
1192	backup.exe
1792	backup.exe
1508	backup.exe
1636	System Restore.exe
1132	backup.exe
1984	backup.exe
1340	backup.exe
832	backup.exe
892	backup.exe
1552	System Restore.exe
896	backup.exe
1648	backup.exe
1608	backup.exe
1820	backup.exe
1276	backup.exe
1128	backup.exe
1960	backup.exe
900	backup.exe
688	update.exe
432	backup.exe
1200	backup.exe
300	backup.exe
932	backup.exe
296	backup.exe
1996	backup.exe
556	backup.exe
1508	backup.exe
1932	backup.exe
1304	backup.exe
2028	backup.exe
1180	backup.exe
672	backup.exe
560	backup.exe
1456	backup.exe
1400	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1548	backup.exe
1548	backup.exe
868	System Restore.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
868	System Restore.exe
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1548	backup.exe
1548	backup.exe
1548	backup.exe
1548	backup.exe
1548	backup.exe
1548	backup.exe
1872	backup.exe
1872	backup.exe
1876	backup.exe
1876	backup.exe
1540	backup.exe
1540	backup.exe
1416	backup.exe
1416	backup.exe
2024	backup.exe
2024	backup.exe
1416	backup.exe
1416	backup.exe
1416	backup.exe
1416	backup.exe
2024	backup.exe
2024	backup.exe
1476	System Restore.exe
1416	backup.exe
1476	System Restore.exe
1416	backup.exe
1416	backup.exe
1476	System Restore.exe
1416	backup.exe
1476	System Restore.exe
1416	backup.exe
1416	backup.exe
1476	System Restore.exe
1476	System Restore.exe
1416	backup.exe
1416	backup.exe
1416	backup.exe
1476	System Restore.exe
1476	System Restore.exe
1416	backup.exe
1996	System Restore.exe
1996	System Restore.exe
1416	backup.exe
1416	backup.exe
1476	System Restore.exe
1476	System Restore.exe

Drops file in Program Files directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\data.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\System Restore.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\System Restore.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe	backup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe
File opened for modification	C:\Windows\addins\backup.exe	backup.exe
File opened for modification	C:\Windows\AppCompat\backup.exe	backup.exe
File opened for modification	C:\Windows\AppPatch\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
1116	backup.exe
592	backup.exe
588	backup.exe
640	backup.exe
1536	backup.exe
1548	backup.exe
540	data.exe
868	System Restore.exe
836	backup.exe
1752	backup.exe
1872	backup.exe
1876	backup.exe
1540	backup.exe
1416	backup.exe
2024	backup.exe
896	backup.exe
1604	backup.exe
1768	backup.exe
608	backup.exe
1476	System Restore.exe
920	backup.exe
900	backup.exe
664	data.exe
1716	System Restore.exe
1776	backup.exe
1060	backup.exe
852	System Restore.exe
1996	System Restore.exe
1192	backup.exe
1792	backup.exe
1508	backup.exe
1636	System Restore.exe
1132	backup.exe
1984	backup.exe
1340	backup.exe
832	backup.exe
892	backup.exe
1552	System Restore.exe
1648	backup.exe
896	backup.exe
1608	backup.exe
1820	backup.exe
1276	backup.exe
1128	backup.exe
1960	backup.exe
900	backup.exe
432	backup.exe
688	update.exe
300	backup.exe
1200	backup.exe
932	backup.exe
296	backup.exe
556	backup.exe
1996	backup.exe
1508	backup.exe
2028	backup.exe
1180	backup.exe
1932	backup.exe
1304	backup.exe
560	backup.exe
672	backup.exe
1400	backup.exe
536	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1116	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	28
PID 1408 wrote to memory of 1116	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	28
PID 1408 wrote to memory of 1116	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	28
PID 1408 wrote to memory of 1116	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	28
PID 1408 wrote to memory of 592	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	29
PID 1408 wrote to memory of 592	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	29
PID 1408 wrote to memory of 592	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	29
PID 1408 wrote to memory of 592	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	29
PID 1408 wrote to memory of 588	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	30
PID 1408 wrote to memory of 588	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	30
PID 1408 wrote to memory of 588	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	30
PID 1408 wrote to memory of 588	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	30
PID 1408 wrote to memory of 640	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	31
PID 1408 wrote to memory of 640	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	31
PID 1408 wrote to memory of 640	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	31
PID 1408 wrote to memory of 640	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	31
PID 1408 wrote to memory of 1536	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	32
PID 1408 wrote to memory of 1536	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	32
PID 1408 wrote to memory of 1536	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	32
PID 1408 wrote to memory of 1536	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	32
PID 1116 wrote to memory of 1548	1116	backup.exe	34
PID 1116 wrote to memory of 1548	1116	backup.exe	34
PID 1116 wrote to memory of 1548	1116	backup.exe	34
PID 1116 wrote to memory of 1548	1116	backup.exe	34
PID 1408 wrote to memory of 540	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	33
PID 1408 wrote to memory of 540	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	33
PID 1408 wrote to memory of 540	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	33
PID 1408 wrote to memory of 540	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	33
PID 1548 wrote to memory of 868	1548	backup.exe	35
PID 1548 wrote to memory of 868	1548	backup.exe	35
PID 1548 wrote to memory of 868	1548	backup.exe	35
PID 1548 wrote to memory of 868	1548	backup.exe	35
PID 868 wrote to memory of 836	868	System Restore.exe	36
PID 868 wrote to memory of 836	868	System Restore.exe	36
PID 868 wrote to memory of 836	868	System Restore.exe	36
PID 868 wrote to memory of 836	868	System Restore.exe	36
PID 1408 wrote to memory of 1752	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	37
PID 1408 wrote to memory of 1752	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	37
PID 1408 wrote to memory of 1752	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	37
PID 1408 wrote to memory of 1752	1408	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe	37
PID 1548 wrote to memory of 1512	1548	backup.exe	38
PID 1548 wrote to memory of 1512	1548	backup.exe	38
PID 1548 wrote to memory of 1512	1548	backup.exe	38
PID 1548 wrote to memory of 1512	1548	backup.exe	38
PID 1548 wrote to memory of 1872	1548	backup.exe	39
PID 1548 wrote to memory of 1872	1548	backup.exe	39
PID 1548 wrote to memory of 1872	1548	backup.exe	39
PID 1548 wrote to memory of 1872	1548	backup.exe	39
PID 1548 wrote to memory of 1876	1548	backup.exe	40
PID 1548 wrote to memory of 1876	1548	backup.exe	40
PID 1548 wrote to memory of 1876	1548	backup.exe	40
PID 1548 wrote to memory of 1876	1548	backup.exe	40
PID 1872 wrote to memory of 1540	1872	backup.exe	41
PID 1872 wrote to memory of 1540	1872	backup.exe	41
PID 1872 wrote to memory of 1540	1872	backup.exe	41
PID 1872 wrote to memory of 1540	1872	backup.exe	41
PID 1876 wrote to memory of 1416	1876	backup.exe	42
PID 1876 wrote to memory of 1416	1876	backup.exe	42
PID 1876 wrote to memory of 1416	1876	backup.exe	42
PID 1876 wrote to memory of 1416	1876	backup.exe	42
PID 1540 wrote to memory of 2024	1540	backup.exe	43
PID 1540 wrote to memory of 2024	1540	backup.exe	43
PID 1540 wrote to memory of 2024	1540	backup.exe	43
PID 1540 wrote to memory of 2024	1540	backup.exe	43

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe

C:\Users\Admin\AppData\Local\Temp\96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe
"C:\Users\Admin\AppData\Local\Temp\96b908f260a9499acf1cc1a5a1f896e62a51a04706fe02e1def1be5343873d1b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1408
- C:\Users\Admin\AppData\Local\Temp\1773458053\backup.exe
  C:\Users\Admin\AppData\Local\Temp\1773458053\backup.exe C:\Users\Admin\AppData\Local\Temp\1773458053\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1116
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1548
  - - C:\PerfLogs\System Restore.exe
      "C:\PerfLogs\System Restore.exe" C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:836
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Executes dropped EXE
      PID:1512
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1540
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2024
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1604
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:920
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1996
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
        9⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1792
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1636
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1984
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:832
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1648
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
        9⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1820
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
        10⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1128
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\update.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
        9⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
        10⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
        9⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:932
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
        10⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2028
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
        9⤵
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:300
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
        9⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1932
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
        8⤵
        
        PID:1604
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
        8⤵
        
        PID:1792
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1996
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:560
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
        9⤵
        
        PID:304
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
        8⤵
        
        PID:1276
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        8⤵
        
        PID:2012
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        
        PID:1616
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:296
      - C:\Program Files (x86)\Common Files\Adobe\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1180
        
        C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
        7⤵
        
        PID:1536
        
        C:\Program Files (x86)\Common Files\Adobe\Help\data.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\data.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
        7⤵
        
        PID:1812
      - C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
        6⤵
        
        PID:1788
      - C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
        
        "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
        6⤵
        
        PID:756
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        
        PID:1360
    - - C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
        5⤵
        
        PID:1920
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1876
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
      - C:\Users\Admin\Desktop\backup.exe
        
        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1768
      - C:\Users\Admin\Documents\backup.exe
        
        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:608
      - C:\Users\Admin\Downloads\backup.exe
        
        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
      - C:\Users\Admin\Favorites\data.exe
        
        C:\Users\Admin\Favorites\data.exe C:\Users\Admin\Favorites\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:664
      - C:\Users\Admin\Links\backup.exe
        
        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1776
      - C:\Users\Admin\Music\System Restore.exe
        
        "C:\Users\Admin\Music\System Restore.exe" C:\Users\Admin\Music\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:852
      - C:\Users\Admin\Pictures\backup.exe
        
        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1192
      - C:\Users\Admin\Saved Games\backup.exe
        
        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1508
      - C:\Users\Admin\Searches\backup.exe
        
        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1132
      - C:\Users\Admin\Videos\backup.exe
        
        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
    - - C:\Users\Public\System Restore.exe
        
        "C:\Users\Public\System Restore.exe" C:\Users\Public\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1552
      - C:\Users\Public\Documents\backup.exe
        
        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:896
      - C:\Users\Public\Downloads\backup.exe
        
        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1608
      - C:\Users\Public\Music\backup.exe
        
        C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1276
        
        C:\Users\Public\Music\Sample Music\backup.exe
        
        "C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1960
      - C:\Users\Public\Pictures\backup.exe
        
        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Users\Public\Pictures\Sample Pictures\backup.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Public\Recorded TV\backup.exe
        
        "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
        
        C:\Users\Public\Recorded TV\Sample Media\backup.exe
        
        "C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1508
      - C:\Users\Public\Videos\backup.exe
        
        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
        6⤵
        Executes dropped EXE
        
        PID:1456
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1200
    - - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
    - - C:\Windows\AppCompat\backup.exe
        
        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
        5⤵
        
        PID:852
    - - C:\Windows\AppPatch\backup.exe
        
        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
        5⤵
        
        PID:1416
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:592
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:588
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:640
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:540
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
441e16e5dad9661e0e5a4faf08b868ee

SHA1
fbe39d6b3be50699584d2a7afb40c1017f78f2b1

SHA256
344c7330a0d9058e664b04739aba301c935f015f7757e58f4c86f17b0ba98752

SHA512
dbdb795058c8b3c083c84c2765ebc69d0cd9a705054a7b6b2cbe2c3858c451d9b3d0103b9261577e4aa46a2467a949dc4b3a872227c2e88ae5b8abd2c42054c5

Download Submit
C:\PerfLogs\System Restore.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
C:\PerfLogs\System Restore.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

Filesize
72KB

MD5
d6d67d3e96bb980a22d211656d05667a

SHA1
292587abc3cc67b68396e6e8a6b3ec98236fe8a7

SHA256
395c24273ac6310db3454ddaf270deccc60baea9165612d9bdac5d155533ebc0

SHA512
5e58291e0f72c56943ecc8b6fb42c36711c714877b44dadc08742eba7ac080847c3b97c4f5461aaa57ce246e6bd9dc6528ceccaea1425d0a20ac3aa5e58b24ab

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe

Filesize
72KB

MD5
6261cf80bf970fcef999b5b21d7726d1

SHA1
a5fc0785cdadbb276d4709e94078a11b88146468

SHA256
8339351aa393315d5e9a28c8f65ef60c400b6636ca13687699871d2dd67a1184

SHA512
c02ffc7b39c94c0923ce5900827217aa6174b15e17f2c08ab8bd4c399ee5570839b27c7b86d1478ad835eb851434484de2294fde0799ad6bf9c267410f0fe45b

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe

Filesize
72KB

MD5
6261cf80bf970fcef999b5b21d7726d1

SHA1
a5fc0785cdadbb276d4709e94078a11b88146468

SHA256
8339351aa393315d5e9a28c8f65ef60c400b6636ca13687699871d2dd67a1184

SHA512
c02ffc7b39c94c0923ce5900827217aa6174b15e17f2c08ab8bd4c399ee5570839b27c7b86d1478ad835eb851434484de2294fde0799ad6bf9c267410f0fe45b

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
6cf4fcef0fcc822b213c58b14bc0e3be

SHA1
bc52c2fd099cc4140b9d66e33aa94c297c75453e

SHA256
24384ee9eb7e1b0f3aa29f702a10be3d1465c97932fddb9d3853f24206156c16

SHA512
5a8fbdb01df0b2ccfc01d76aaaba7d781eb2cf677f27dd070efc772330672d51d33a119b42b93444d97a18df673f968f8710e8092b460b88b6814f240612bfcc

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
6cf4fcef0fcc822b213c58b14bc0e3be

SHA1
bc52c2fd099cc4140b9d66e33aa94c297c75453e

SHA256
24384ee9eb7e1b0f3aa29f702a10be3d1465c97932fddb9d3853f24206156c16

SHA512
5a8fbdb01df0b2ccfc01d76aaaba7d781eb2cf677f27dd070efc772330672d51d33a119b42b93444d97a18df673f968f8710e8092b460b88b6814f240612bfcc

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
8f48c17f340fdf3b88edab966eb732ef

SHA1
3ce6ca18ae36b3374c1c59a4f3960d021f12b635

SHA256
c71f9573032a103de15b8a06778e2230400f912b60ef4218c4bca875e376488e

SHA512
94f6c12af5195611cef3e435d6fda359df190c8e07b97dc8d3b9e679b3d7d3bf5c74b756168e0708410d2fdcc6d0a17bf9a80a20a3f79a99a8986d3bf07fc635

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
8f48c17f340fdf3b88edab966eb732ef

SHA1
3ce6ca18ae36b3374c1c59a4f3960d021f12b635

SHA256
c71f9573032a103de15b8a06778e2230400f912b60ef4218c4bca875e376488e

SHA512
94f6c12af5195611cef3e435d6fda359df190c8e07b97dc8d3b9e679b3d7d3bf5c74b756168e0708410d2fdcc6d0a17bf9a80a20a3f79a99a8986d3bf07fc635

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
C:\Users\Admin\AppData\Local\Temp\1773458053\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1773458053\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
514d4888d3cccd095769fdcc66344b08

SHA1
4efac50934a82e5e0b6c3d9ca19d98f14e66fb9e

SHA256
d0966e3c773e60b16d4dfa3118d2cb6d7e4292d9c34c9e8fa61d9ba5d3bee778

SHA512
008a5b0fb1fa8da11619d5af0ec8d42b29bcc06fe7b7f47fccd465ec6daf0fd736433f90e1b511c59b184563d3ec7a90bdac00d1822477d50cff32e58473392c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
cb58d332a4af532caf6c0ec8df365748

SHA1
294799c22b3ed2fc0a9f65210d2bb8c852105692

SHA256
58868fd2f69567a3a2647d973b9303b09e812e958451ad70912c45fed6e02764

SHA512
e87b30a79ee223d9507554c2d8c98ad17e03c711e8a0239db66e169746bcb5ea7ae3529da1fead103da47a7eebfb6585d5db31cedc7a5c1e7d8d6cee60617990

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

Filesize
72KB

MD5
cb58d332a4af532caf6c0ec8df365748

SHA1
294799c22b3ed2fc0a9f65210d2bb8c852105692

SHA256
58868fd2f69567a3a2647d973b9303b09e812e958451ad70912c45fed6e02764

SHA512
e87b30a79ee223d9507554c2d8c98ad17e03c711e8a0239db66e169746bcb5ea7ae3529da1fead103da47a7eebfb6585d5db31cedc7a5c1e7d8d6cee60617990

Download Submit
C:\Users\Admin\Contacts\backup.exe

Filesize
72KB

MD5
ca33e6e06ca2b7ea0c643b8048895496

SHA1
2c19833c65e0df8cbaa46c9a16126bac47f67918

SHA256
8f217824a03659358ec759e699edd8be49b2df0b0aab06c00fdcf490cbc4bf45

SHA512
75247663d67623897d28bb993909bf97b9edd2a008c5b34443f5bb9b66373f123d15e270d1c117477570d7e90c5ac6b957c71e3d28f8bf720933fb4639370c36

Download Submit
C:\Users\Admin\Desktop\backup.exe

Filesize
72KB

MD5
ca33e6e06ca2b7ea0c643b8048895496

SHA1
2c19833c65e0df8cbaa46c9a16126bac47f67918

SHA256
8f217824a03659358ec759e699edd8be49b2df0b0aab06c00fdcf490cbc4bf45

SHA512
75247663d67623897d28bb993909bf97b9edd2a008c5b34443f5bb9b66373f123d15e270d1c117477570d7e90c5ac6b957c71e3d28f8bf720933fb4639370c36

Download Submit
C:\Users\Admin\backup.exe

Filesize
72KB

MD5
85deb5f7b103d3c7aff50c447d103ecb

SHA1
3ca1d391c7de9a9727c54da981032b3813feb8d5

SHA256
48908f6d1bd9763a8e43a098a02d50f11d89aa491e7e1c3a3372a243362456fa

SHA512
f71498990b18a461ece63e7fa8c82d702e112eed72ec3ca519dea8a477deec62bc3695069417d7b0849ef8371b6029772812e78ffaa7941a8b44b4e621f9009e

Download Submit
C:\Users\Admin\backup.exe

Filesize
72KB

MD5
85deb5f7b103d3c7aff50c447d103ecb

SHA1
3ca1d391c7de9a9727c54da981032b3813feb8d5

SHA256
48908f6d1bd9763a8e43a098a02d50f11d89aa491e7e1c3a3372a243362456fa

SHA512
f71498990b18a461ece63e7fa8c82d702e112eed72ec3ca519dea8a477deec62bc3695069417d7b0849ef8371b6029772812e78ffaa7941a8b44b4e621f9009e

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
1744fdb4f6461029d772114bf0d606e1

SHA1
de50d8846a0570344d007f1882b798b1c97fa7e0

SHA256
48d9d7c91b1f8ef50727bb00788be3e91d1fdfdbaf182c20938adba21ac3af88

SHA512
f11c62300ee0d65d9a5faf818d273350cb1218cab43bf17f033f75744e69f90fdfdd8511846389496f1cddecf758e32f3bd61584bc1bc0a46b3ad8fb6ccf7728

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
1744fdb4f6461029d772114bf0d606e1

SHA1
de50d8846a0570344d007f1882b798b1c97fa7e0

SHA256
48d9d7c91b1f8ef50727bb00788be3e91d1fdfdbaf182c20938adba21ac3af88

SHA512
f11c62300ee0d65d9a5faf818d273350cb1218cab43bf17f033f75744e69f90fdfdd8511846389496f1cddecf758e32f3bd61584bc1bc0a46b3ad8fb6ccf7728

Download Submit
C:\backup.exe

Filesize
72KB

MD5
83d701cd5cfd8df420cc0569a7d3a133

SHA1
846f0a5a1602b56716f1bca5fcd273b04f28c0de

SHA256
cbe1b9ec4ef83992cb7d4ab9f8a7f24338618dcfd3e582a44af877e104bc804b

SHA512
76d545b9669ef67dc7ccf65d166448756e207326d5c25871666cccdddf820b4b36467064d5fe8f5d8450c2b9f94b63b1a219a7b5beecce3832f032a3d0b1d61a

Download Submit
C:\backup.exe

Filesize
72KB

MD5
83d701cd5cfd8df420cc0569a7d3a133

SHA1
846f0a5a1602b56716f1bca5fcd273b04f28c0de

SHA256
cbe1b9ec4ef83992cb7d4ab9f8a7f24338618dcfd3e582a44af877e104bc804b

SHA512
76d545b9669ef67dc7ccf65d166448756e207326d5c25871666cccdddf820b4b36467064d5fe8f5d8450c2b9f94b63b1a219a7b5beecce3832f032a3d0b1d61a

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
441e16e5dad9661e0e5a4faf08b868ee

SHA1
fbe39d6b3be50699584d2a7afb40c1017f78f2b1

SHA256
344c7330a0d9058e664b04739aba301c935f015f7757e58f4c86f17b0ba98752

SHA512
dbdb795058c8b3c083c84c2765ebc69d0cd9a705054a7b6b2cbe2c3858c451d9b3d0103b9261577e4aa46a2467a949dc4b3a872227c2e88ae5b8abd2c42054c5

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
441e16e5dad9661e0e5a4faf08b868ee

SHA1
fbe39d6b3be50699584d2a7afb40c1017f78f2b1

SHA256
344c7330a0d9058e664b04739aba301c935f015f7757e58f4c86f17b0ba98752

SHA512
dbdb795058c8b3c083c84c2765ebc69d0cd9a705054a7b6b2cbe2c3858c451d9b3d0103b9261577e4aa46a2467a949dc4b3a872227c2e88ae5b8abd2c42054c5

Download Submit
\PerfLogs\System Restore.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
\PerfLogs\System Restore.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

Filesize
72KB

MD5
d6d67d3e96bb980a22d211656d05667a

SHA1
292587abc3cc67b68396e6e8a6b3ec98236fe8a7

SHA256
395c24273ac6310db3454ddaf270deccc60baea9165612d9bdac5d155533ebc0

SHA512
5e58291e0f72c56943ecc8b6fb42c36711c714877b44dadc08742eba7ac080847c3b97c4f5461aaa57ce246e6bd9dc6528ceccaea1425d0a20ac3aa5e58b24ab

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

Filesize
72KB

MD5
d6d67d3e96bb980a22d211656d05667a

SHA1
292587abc3cc67b68396e6e8a6b3ec98236fe8a7

SHA256
395c24273ac6310db3454ddaf270deccc60baea9165612d9bdac5d155533ebc0

SHA512
5e58291e0f72c56943ecc8b6fb42c36711c714877b44dadc08742eba7ac080847c3b97c4f5461aaa57ce246e6bd9dc6528ceccaea1425d0a20ac3aa5e58b24ab

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\backup.exe

Filesize
72KB

MD5
6261cf80bf970fcef999b5b21d7726d1

SHA1
a5fc0785cdadbb276d4709e94078a11b88146468

SHA256
8339351aa393315d5e9a28c8f65ef60c400b6636ca13687699871d2dd67a1184

SHA512
c02ffc7b39c94c0923ce5900827217aa6174b15e17f2c08ab8bd4c399ee5570839b27c7b86d1478ad835eb851434484de2294fde0799ad6bf9c267410f0fe45b

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\backup.exe

Filesize
72KB

MD5
6261cf80bf970fcef999b5b21d7726d1

SHA1
a5fc0785cdadbb276d4709e94078a11b88146468

SHA256
8339351aa393315d5e9a28c8f65ef60c400b6636ca13687699871d2dd67a1184

SHA512
c02ffc7b39c94c0923ce5900827217aa6174b15e17f2c08ab8bd4c399ee5570839b27c7b86d1478ad835eb851434484de2294fde0799ad6bf9c267410f0fe45b

Download Submit
\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
6cf4fcef0fcc822b213c58b14bc0e3be

SHA1
bc52c2fd099cc4140b9d66e33aa94c297c75453e

SHA256
24384ee9eb7e1b0f3aa29f702a10be3d1465c97932fddb9d3853f24206156c16

SHA512
5a8fbdb01df0b2ccfc01d76aaaba7d781eb2cf677f27dd070efc772330672d51d33a119b42b93444d97a18df673f968f8710e8092b460b88b6814f240612bfcc

Download Submit
\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
6cf4fcef0fcc822b213c58b14bc0e3be

SHA1
bc52c2fd099cc4140b9d66e33aa94c297c75453e

SHA256
24384ee9eb7e1b0f3aa29f702a10be3d1465c97932fddb9d3853f24206156c16

SHA512
5a8fbdb01df0b2ccfc01d76aaaba7d781eb2cf677f27dd070efc772330672d51d33a119b42b93444d97a18df673f968f8710e8092b460b88b6814f240612bfcc

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
8f48c17f340fdf3b88edab966eb732ef

SHA1
3ce6ca18ae36b3374c1c59a4f3960d021f12b635

SHA256
c71f9573032a103de15b8a06778e2230400f912b60ef4218c4bca875e376488e

SHA512
94f6c12af5195611cef3e435d6fda359df190c8e07b97dc8d3b9e679b3d7d3bf5c74b756168e0708410d2fdcc6d0a17bf9a80a20a3f79a99a8986d3bf07fc635

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
8f48c17f340fdf3b88edab966eb732ef

SHA1
3ce6ca18ae36b3374c1c59a4f3960d021f12b635

SHA256
c71f9573032a103de15b8a06778e2230400f912b60ef4218c4bca875e376488e

SHA512
94f6c12af5195611cef3e435d6fda359df190c8e07b97dc8d3b9e679b3d7d3bf5c74b756168e0708410d2fdcc6d0a17bf9a80a20a3f79a99a8986d3bf07fc635

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
c48872717c24e32cd14ca54bf34d10ca

SHA1
936c4770efadc7d71daa3101b451baa939c65eb8

SHA256
803ddbc89335539d289abf4bd0bb84a6d6994c45776abf2ed5012bd25e4c2e42

SHA512
844e9020cd85283bdc96a5f4ca329c09b8a5ffc1e4b9488ebe92a15750cb978743a8870507b1771929fc12ebc1b4e603965de757ad833e0c77a40aa91dbdc225

Download Submit
\Users\Admin\AppData\Local\Temp\1773458053\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\1773458053\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
514d4888d3cccd095769fdcc66344b08

SHA1
4efac50934a82e5e0b6c3d9ca19d98f14e66fb9e

SHA256
d0966e3c773e60b16d4dfa3118d2cb6d7e4292d9c34c9e8fa61d9ba5d3bee778

SHA512
008a5b0fb1fa8da11619d5af0ec8d42b29bcc06fe7b7f47fccd465ec6daf0fd736433f90e1b511c59b184563d3ec7a90bdac00d1822477d50cff32e58473392c

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
514d4888d3cccd095769fdcc66344b08

SHA1
4efac50934a82e5e0b6c3d9ca19d98f14e66fb9e

SHA256
d0966e3c773e60b16d4dfa3118d2cb6d7e4292d9c34c9e8fa61d9ba5d3bee778

SHA512
008a5b0fb1fa8da11619d5af0ec8d42b29bcc06fe7b7f47fccd465ec6daf0fd736433f90e1b511c59b184563d3ec7a90bdac00d1822477d50cff32e58473392c

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
cb58d332a4af532caf6c0ec8df365748

SHA1
294799c22b3ed2fc0a9f65210d2bb8c852105692

SHA256
58868fd2f69567a3a2647d973b9303b09e812e958451ad70912c45fed6e02764

SHA512
e87b30a79ee223d9507554c2d8c98ad17e03c711e8a0239db66e169746bcb5ea7ae3529da1fead103da47a7eebfb6585d5db31cedc7a5c1e7d8d6cee60617990

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
cb58d332a4af532caf6c0ec8df365748

SHA1
294799c22b3ed2fc0a9f65210d2bb8c852105692

SHA256
58868fd2f69567a3a2647d973b9303b09e812e958451ad70912c45fed6e02764

SHA512
e87b30a79ee223d9507554c2d8c98ad17e03c711e8a0239db66e169746bcb5ea7ae3529da1fead103da47a7eebfb6585d5db31cedc7a5c1e7d8d6cee60617990

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
af477008313e95b9c7c7b026080a8a0a

SHA1
15752cac1c9fa0b3da732d78ee582b3f7beec8cb

SHA256
168167b73675b32b4b5892223dbe913cfe89c6913892fe436d3ce1a157ec89f8

SHA512
d5503956df4ec6b47398bc6ab7c4504e6b51c714baf1d5b2001fff9a15f743ec6986d0a6187b3fe5b72912578ccd50af5006907279be3fb570d5d79337341e2a

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

Filesize
72KB

MD5
cb58d332a4af532caf6c0ec8df365748

SHA1
294799c22b3ed2fc0a9f65210d2bb8c852105692

SHA256
58868fd2f69567a3a2647d973b9303b09e812e958451ad70912c45fed6e02764

SHA512
e87b30a79ee223d9507554c2d8c98ad17e03c711e8a0239db66e169746bcb5ea7ae3529da1fead103da47a7eebfb6585d5db31cedc7a5c1e7d8d6cee60617990

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

Filesize
72KB

MD5
cb58d332a4af532caf6c0ec8df365748

SHA1
294799c22b3ed2fc0a9f65210d2bb8c852105692

SHA256
58868fd2f69567a3a2647d973b9303b09e812e958451ad70912c45fed6e02764

SHA512
e87b30a79ee223d9507554c2d8c98ad17e03c711e8a0239db66e169746bcb5ea7ae3529da1fead103da47a7eebfb6585d5db31cedc7a5c1e7d8d6cee60617990

Download Submit
\Users\Admin\Contacts\backup.exe

Filesize
72KB

MD5
ca33e6e06ca2b7ea0c643b8048895496

SHA1
2c19833c65e0df8cbaa46c9a16126bac47f67918

SHA256
8f217824a03659358ec759e699edd8be49b2df0b0aab06c00fdcf490cbc4bf45

SHA512
75247663d67623897d28bb993909bf97b9edd2a008c5b34443f5bb9b66373f123d15e270d1c117477570d7e90c5ac6b957c71e3d28f8bf720933fb4639370c36

Download Submit
\Users\Admin\Contacts\backup.exe

Filesize
72KB

MD5
ca33e6e06ca2b7ea0c643b8048895496

SHA1
2c19833c65e0df8cbaa46c9a16126bac47f67918

SHA256
8f217824a03659358ec759e699edd8be49b2df0b0aab06c00fdcf490cbc4bf45

SHA512
75247663d67623897d28bb993909bf97b9edd2a008c5b34443f5bb9b66373f123d15e270d1c117477570d7e90c5ac6b957c71e3d28f8bf720933fb4639370c36

Download Submit
\Users\Admin\Desktop\backup.exe

Filesize
72KB

MD5
ca33e6e06ca2b7ea0c643b8048895496

SHA1
2c19833c65e0df8cbaa46c9a16126bac47f67918

SHA256
8f217824a03659358ec759e699edd8be49b2df0b0aab06c00fdcf490cbc4bf45

SHA512
75247663d67623897d28bb993909bf97b9edd2a008c5b34443f5bb9b66373f123d15e270d1c117477570d7e90c5ac6b957c71e3d28f8bf720933fb4639370c36

Download Submit
\Users\Admin\Desktop\backup.exe

Filesize
72KB

MD5
ca33e6e06ca2b7ea0c643b8048895496

SHA1
2c19833c65e0df8cbaa46c9a16126bac47f67918

SHA256
8f217824a03659358ec759e699edd8be49b2df0b0aab06c00fdcf490cbc4bf45

SHA512
75247663d67623897d28bb993909bf97b9edd2a008c5b34443f5bb9b66373f123d15e270d1c117477570d7e90c5ac6b957c71e3d28f8bf720933fb4639370c36

Download Submit
\Users\Admin\Documents\backup.exe

Filesize
72KB

MD5
e8e9448d39e87f97a9d32526946933b1

SHA1
0315d03ab95cc6af937719a143ef3c55c556f836

SHA256
4be0827347aa91d4521585ca2ae9d30268976b16e12192f0c427b9fe3c7ab082

SHA512
f0aff920aad5f7624351ce9c20860bfb6b30d2107c3076e92afc5aca842b9945fabe33d94505d67c4eaac7e95f4211d70b762fcd54be5e6739021850c1f9268f

Download Submit
\Users\Admin\backup.exe

Filesize
72KB

MD5
85deb5f7b103d3c7aff50c447d103ecb

SHA1
3ca1d391c7de9a9727c54da981032b3813feb8d5

SHA256
48908f6d1bd9763a8e43a098a02d50f11d89aa491e7e1c3a3372a243362456fa

SHA512
f71498990b18a461ece63e7fa8c82d702e112eed72ec3ca519dea8a477deec62bc3695069417d7b0849ef8371b6029772812e78ffaa7941a8b44b4e621f9009e

Download Submit
\Users\Admin\backup.exe

Filesize
72KB

MD5
85deb5f7b103d3c7aff50c447d103ecb

SHA1
3ca1d391c7de9a9727c54da981032b3813feb8d5

SHA256
48908f6d1bd9763a8e43a098a02d50f11d89aa491e7e1c3a3372a243362456fa

SHA512
f71498990b18a461ece63e7fa8c82d702e112eed72ec3ca519dea8a477deec62bc3695069417d7b0849ef8371b6029772812e78ffaa7941a8b44b4e621f9009e

Download Submit
\Users\backup.exe

Filesize
72KB

MD5
1744fdb4f6461029d772114bf0d606e1

SHA1
de50d8846a0570344d007f1882b798b1c97fa7e0

SHA256
48d9d7c91b1f8ef50727bb00788be3e91d1fdfdbaf182c20938adba21ac3af88

SHA512
f11c62300ee0d65d9a5faf818d273350cb1218cab43bf17f033f75744e69f90fdfdd8511846389496f1cddecf758e32f3bd61584bc1bc0a46b3ad8fb6ccf7728

Download Submit
\Users\backup.exe

Filesize
72KB

MD5
1744fdb4f6461029d772114bf0d606e1

SHA1
de50d8846a0570344d007f1882b798b1c97fa7e0

SHA256
48d9d7c91b1f8ef50727bb00788be3e91d1fdfdbaf182c20938adba21ac3af88

SHA512
f11c62300ee0d65d9a5faf818d273350cb1218cab43bf17f033f75744e69f90fdfdd8511846389496f1cddecf758e32f3bd61584bc1bc0a46b3ad8fb6ccf7728

Download Submit
memory/1408-121-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1408-123-0x0000000074231000-0x0000000074233000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads