Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe
Resource
win10v2004-20221111-en
General
-
Target
5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe
-
Size
72KB
-
MD5
009526ec342bb66c96f4f8ecbb0f2402
-
SHA1
93cd14633cac26aa84533c91452f8dbd73be4874
-
SHA256
5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3
-
SHA512
ed0034cbd72e06a50df9e70e9d6de65e27f61080d1ca453bd0a6b3fd3cfb0678dcee976d1938fb655d101ae93b1e4468c3e6e4a5879a4a80a302f04ef5a86b6a
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2z:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPH
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 332 data.exe 580 backup.exe 864 backup.exe 476 update.exe 1932 backup.exe 1328 data.exe 1580 data.exe 1540 backup.exe 1604 backup.exe 1876 backup.exe 1836 backup.exe 1976 backup.exe 1172 backup.exe 940 backup.exe 1972 backup.exe 1620 backup.exe 2024 backup.exe 1500 backup.exe 1204 backup.exe 828 backup.exe 904 backup.exe 992 backup.exe 1156 backup.exe 1160 backup.exe 300 backup.exe 1312 backup.exe 1328 backup.exe 988 data.exe 1896 backup.exe 1540 backup.exe 112 data.exe 764 backup.exe 1692 backup.exe 1940 backup.exe 848 backup.exe 1224 backup.exe 652 data.exe 1916 backup.exe 1960 backup.exe 952 backup.exe 1996 backup.exe 1684 backup.exe 1212 backup.exe 1600 backup.exe 1492 backup.exe 588 backup.exe 1068 backup.exe 556 backup.exe 440 backup.exe 528 backup.exe 1424 backup.exe 1932 backup.exe 984 backup.exe 1680 backup.exe 692 backup.exe 1176 backup.exe 1324 backup.exe 1196 backup.exe 936 backup.exe 1272 backup.exe 1648 backup.exe 1728 backup.exe 620 update.exe 1412 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 476 update.exe 476 update.exe 476 update.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 1580 data.exe 1580 data.exe 1604 backup.exe 1604 backup.exe 1580 data.exe 1580 data.exe 1836 backup.exe 1836 backup.exe 1976 backup.exe 1976 backup.exe 1836 backup.exe 1836 backup.exe 940 backup.exe 940 backup.exe 1972 backup.exe 1972 backup.exe 1972 backup.exe 1972 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 2024 backup.exe 1896 backup.exe 1896 backup.exe 1896 backup.exe 1896 backup.exe 1896 backup.exe 1896 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 332 data.exe 580 backup.exe 864 backup.exe 476 update.exe 1932 backup.exe 1328 data.exe 1580 data.exe 1540 backup.exe 1604 backup.exe 1876 backup.exe 1836 backup.exe 1976 backup.exe 1172 backup.exe 940 backup.exe 1972 backup.exe 1620 backup.exe 2024 backup.exe 1500 backup.exe 1204 backup.exe 828 backup.exe 904 backup.exe 992 backup.exe 1156 backup.exe 1160 backup.exe 300 backup.exe 1312 backup.exe 1328 backup.exe 988 data.exe 1896 backup.exe 1540 backup.exe 112 data.exe 764 backup.exe 1692 backup.exe 1940 backup.exe 848 backup.exe 1224 backup.exe 652 data.exe 1916 backup.exe 1960 backup.exe 952 backup.exe 1996 backup.exe 1684 backup.exe 1212 backup.exe 1600 backup.exe 1492 backup.exe 588 backup.exe 1068 backup.exe 556 backup.exe 440 backup.exe 528 backup.exe 1424 backup.exe 1932 backup.exe 984 backup.exe 1680 backup.exe 692 backup.exe 1176 backup.exe 1324 backup.exe 1196 backup.exe 936 backup.exe 1272 backup.exe 1648 backup.exe 1728 backup.exe 620 update.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1416 wrote to memory of 332 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 28 PID 1416 wrote to memory of 332 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 28 PID 1416 wrote to memory of 332 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 28 PID 1416 wrote to memory of 332 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 28 PID 1416 wrote to memory of 580 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 29 PID 1416 wrote to memory of 580 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 29 PID 1416 wrote to memory of 580 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 29 PID 1416 wrote to memory of 580 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 29 PID 1416 wrote to memory of 864 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 30 PID 1416 wrote to memory of 864 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 30 PID 1416 wrote to memory of 864 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 30 PID 1416 wrote to memory of 864 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 30 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 476 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 31 PID 1416 wrote to memory of 1932 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 32 PID 1416 wrote to memory of 1932 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 32 PID 1416 wrote to memory of 1932 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 32 PID 1416 wrote to memory of 1932 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 32 PID 332 wrote to memory of 1580 332 data.exe 34 PID 332 wrote to memory of 1580 332 data.exe 34 PID 332 wrote to memory of 1580 332 data.exe 34 PID 332 wrote to memory of 1580 332 data.exe 34 PID 1416 wrote to memory of 1328 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 33 PID 1416 wrote to memory of 1328 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 33 PID 1416 wrote to memory of 1328 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 33 PID 1416 wrote to memory of 1328 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 33 PID 1416 wrote to memory of 1540 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 35 PID 1416 wrote to memory of 1540 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 35 PID 1416 wrote to memory of 1540 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 35 PID 1416 wrote to memory of 1540 1416 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe 35 PID 1580 wrote to memory of 1604 1580 data.exe 36 PID 1580 wrote to memory of 1604 1580 data.exe 36 PID 1580 wrote to memory of 1604 1580 data.exe 36 PID 1580 wrote to memory of 1604 1580 data.exe 36 PID 1604 wrote to memory of 1876 1604 backup.exe 37 PID 1604 wrote to memory of 1876 1604 backup.exe 37 PID 1604 wrote to memory of 1876 1604 backup.exe 37 PID 1604 wrote to memory of 1876 1604 backup.exe 37 PID 1580 wrote to memory of 1836 1580 data.exe 38 PID 1580 wrote to memory of 1836 1580 data.exe 38 PID 1580 wrote to memory of 1836 1580 data.exe 38 PID 1580 wrote to memory of 1836 1580 data.exe 38 PID 1836 wrote to memory of 1976 1836 backup.exe 39 PID 1836 wrote to memory of 1976 1836 backup.exe 39 PID 1836 wrote to memory of 1976 1836 backup.exe 39 PID 1836 wrote to memory of 1976 1836 backup.exe 39 PID 1976 wrote to memory of 1172 1976 backup.exe 40 PID 1976 wrote to memory of 1172 1976 backup.exe 40 PID 1976 wrote to memory of 1172 1976 backup.exe 40 PID 1976 wrote to memory of 1172 1976 backup.exe 40 PID 1836 wrote to memory of 940 1836 backup.exe 41 PID 1836 wrote to memory of 940 1836 backup.exe 41 PID 1836 wrote to memory of 940 1836 backup.exe 41 PID 1836 wrote to memory of 940 1836 backup.exe 41 PID 940 wrote to memory of 1972 940 backup.exe 42 PID 940 wrote to memory of 1972 940 backup.exe 42 PID 940 wrote to memory of 1972 940 backup.exe 42 PID 940 wrote to memory of 1972 940 backup.exe 42 PID 1972 wrote to memory of 1620 1972 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe"C:\Users\Admin\AppData\Local\Temp\5b0965fd1095800e9a17bff3f18b2ceb372f616ce7b27b19cadb22a6f14dc4f3.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1225508760\data.exeC:\Users\Admin\AppData\Local\Temp\1225508760\data.exe C:\Users\Admin\AppData\Local\Temp\1225508760\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:332 -
C:\data.exe\data.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1580 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1604 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1172
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:940 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1500
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:828
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:992
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1160
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:300
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:988
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1896 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:764
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:848
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1916
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:556
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:440
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1424
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:692
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:936
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1272
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:620
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
PID:1412 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1208
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1484
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1356
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1144
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:964
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1732
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1996 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1624
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1496
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Drops file in Program Files directory
- System policy modification
PID:532 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1200
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1312
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵PID:832
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:904 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1052
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1264
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1484
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵PID:1508
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:884
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2016
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
PID:1068
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Disables RegEdit via registry modification
PID:1640 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\update.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\update.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
PID:1724
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵PID:1000
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵PID:1396
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1192
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1264
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1268
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:828
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:936
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:380 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2012
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1800
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:992
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1196
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:1780
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1960
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1540
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1664 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1424 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
PID:988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵PID:764
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵PID:1080
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:1380
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:664
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:1992
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵PID:1220
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1500
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1144
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1756
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:476
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:764
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1576
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1956
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:812
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:864
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:476
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1540
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5b4642480f54092299a2f1c98050c882e
SHA17db0e273b0dc80c373eb77dec51fe5bbe5cca282
SHA256f98b153111331810bc1b6ee24aabdcc54c98bac74f739fbb96734c307a723385
SHA512eff1336d7461d453716f6c776117be71fc6b43c8a7d50bc19248e2eaabe00d7e91d621e7560c60589a8ba3f71afbaa821311a102605ba3a8b8a0814107b7a35e
-
Filesize
72KB
MD5aec9582f8209ee9d1c01c5b6d21a1d62
SHA1a0323b5589a4b874ce3290b1cfe3da2a60c6fc98
SHA256ef8d403c812d314ffd0b9453af16a3c5ce02c407912498a1f0b51914d9626549
SHA51256f8c02688079fa910a5360487ed8692410dc3c087eb98d8aeb0f36148bdd9a22516227d5fae5385f9db6baa7db9667a613f0aac381d1d1f8f235b25b317b693
-
Filesize
72KB
MD5aec9582f8209ee9d1c01c5b6d21a1d62
SHA1a0323b5589a4b874ce3290b1cfe3da2a60c6fc98
SHA256ef8d403c812d314ffd0b9453af16a3c5ce02c407912498a1f0b51914d9626549
SHA51256f8c02688079fa910a5360487ed8692410dc3c087eb98d8aeb0f36148bdd9a22516227d5fae5385f9db6baa7db9667a613f0aac381d1d1f8f235b25b317b693
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD56e88a13e8cf1316d4da9c70d21ac6093
SHA1566d4aae6dd66be3248b11b35b2926a0a3f58718
SHA256d9c8e57a66c379e632028acc96d80cbe7ef3b0567eba70be567b2c2aaecf1427
SHA51242c5de8aa3bf7cadab6b89cce1150c00c807680927e11525c10b3218d2550c6866464421fd044f95c49fe8ceed014817c3238a1c0a84495b1abff9b5149bc528
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD525cf1d0166cb58b1b55fe106bf4bb5e3
SHA1c7d0db4c8d3cd187f840110b0933cacd2c18f2ee
SHA25698a78d78a99f5ffb0abc58277a36bca13bf45f8d2e3b9d9ddb2f79ba0194529f
SHA5125d6fe2dbe97397becb2d5c7557c015dbff4811d94951ea34a637084045d905e541df2bbbabe72f29f833eb6315a7a4c7a0d181a5b58ca9cc6c7d146e089b64e8
-
Filesize
72KB
MD56f4c21363737836b8279af6c8165987d
SHA1762da69c221677388fbb3cd9263e6dbe1f1c0b61
SHA25695cf40d74042694bab049020094b51131d1700078f3485e4898b5a89aca7e104
SHA512c51869194b71fd4000501099ceecd2a7a1fd815621dc1d5238e9dbf3dcfc438bfb016fb4615aadead4b1f7ba2891aa13d22ed142408337d3d09f9647a8c2b70c
-
Filesize
72KB
MD56f4c21363737836b8279af6c8165987d
SHA1762da69c221677388fbb3cd9263e6dbe1f1c0b61
SHA25695cf40d74042694bab049020094b51131d1700078f3485e4898b5a89aca7e104
SHA512c51869194b71fd4000501099ceecd2a7a1fd815621dc1d5238e9dbf3dcfc438bfb016fb4615aadead4b1f7ba2891aa13d22ed142408337d3d09f9647a8c2b70c
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD598333a455d6ef0a7a501578ae93927a0
SHA188273f6a8fbf985e0c8a749a64d0a15c201d1e49
SHA2561a3f8c691585abfca897a4347aadfa4de00acf4498d8de4aae4b8c4fefacf1a2
SHA512d759c7bc55a433fd9a6b57da0a888ee2f934df16a866d6861f5424077cc347ac9b5c073efd2c15d932b8f3308076c6fd6705b85fd90d3945f3c6cf4af7d781d3
-
Filesize
72KB
MD598333a455d6ef0a7a501578ae93927a0
SHA188273f6a8fbf985e0c8a749a64d0a15c201d1e49
SHA2561a3f8c691585abfca897a4347aadfa4de00acf4498d8de4aae4b8c4fefacf1a2
SHA512d759c7bc55a433fd9a6b57da0a888ee2f934df16a866d6861f5424077cc347ac9b5c073efd2c15d932b8f3308076c6fd6705b85fd90d3945f3c6cf4af7d781d3
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD5ebffb743124335505a4e56b474284f35
SHA1079a3133af415a5a23669af2d04698a87e7ee451
SHA256395fc4949de488543838a2c0b437eac11b4c49cd94d2642c79f18b6094eddda6
SHA512f8d9c973ce47d50dea1389772d2559e6209430f0383386175746febfae8df6bc6ecfb02387c26579c449c53e74f3bb9de7ae5b97e51f474fbfc32f1df2ba7150
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD5ebffb743124335505a4e56b474284f35
SHA1079a3133af415a5a23669af2d04698a87e7ee451
SHA256395fc4949de488543838a2c0b437eac11b4c49cd94d2642c79f18b6094eddda6
SHA512f8d9c973ce47d50dea1389772d2559e6209430f0383386175746febfae8df6bc6ecfb02387c26579c449c53e74f3bb9de7ae5b97e51f474fbfc32f1df2ba7150
-
Filesize
72KB
MD5fcb2ced7df1c09ec6c8b71def85a3f6a
SHA14f607fb2b5a979aa5b1e696934a0883929780a50
SHA256e3c322d8bb002a1d27016808ba811edb47ecaff3d0edd1e8d295e874f4437016
SHA51220e6e2aeb69bd992949b44d6456e7ef73e2a4b0a2958421faa1fa3021f57a66a0a10fe26a93a6c09c8743c275424d8b5d8b5d98c909e493cd6042f0f04ce9c04
-
Filesize
72KB
MD5fcb2ced7df1c09ec6c8b71def85a3f6a
SHA14f607fb2b5a979aa5b1e696934a0883929780a50
SHA256e3c322d8bb002a1d27016808ba811edb47ecaff3d0edd1e8d295e874f4437016
SHA51220e6e2aeb69bd992949b44d6456e7ef73e2a4b0a2958421faa1fa3021f57a66a0a10fe26a93a6c09c8743c275424d8b5d8b5d98c909e493cd6042f0f04ce9c04
-
Filesize
72KB
MD5b4642480f54092299a2f1c98050c882e
SHA17db0e273b0dc80c373eb77dec51fe5bbe5cca282
SHA256f98b153111331810bc1b6ee24aabdcc54c98bac74f739fbb96734c307a723385
SHA512eff1336d7461d453716f6c776117be71fc6b43c8a7d50bc19248e2eaabe00d7e91d621e7560c60589a8ba3f71afbaa821311a102605ba3a8b8a0814107b7a35e
-
Filesize
72KB
MD5b4642480f54092299a2f1c98050c882e
SHA17db0e273b0dc80c373eb77dec51fe5bbe5cca282
SHA256f98b153111331810bc1b6ee24aabdcc54c98bac74f739fbb96734c307a723385
SHA512eff1336d7461d453716f6c776117be71fc6b43c8a7d50bc19248e2eaabe00d7e91d621e7560c60589a8ba3f71afbaa821311a102605ba3a8b8a0814107b7a35e
-
Filesize
72KB
MD5aec9582f8209ee9d1c01c5b6d21a1d62
SHA1a0323b5589a4b874ce3290b1cfe3da2a60c6fc98
SHA256ef8d403c812d314ffd0b9453af16a3c5ce02c407912498a1f0b51914d9626549
SHA51256f8c02688079fa910a5360487ed8692410dc3c087eb98d8aeb0f36148bdd9a22516227d5fae5385f9db6baa7db9667a613f0aac381d1d1f8f235b25b317b693
-
Filesize
72KB
MD5aec9582f8209ee9d1c01c5b6d21a1d62
SHA1a0323b5589a4b874ce3290b1cfe3da2a60c6fc98
SHA256ef8d403c812d314ffd0b9453af16a3c5ce02c407912498a1f0b51914d9626549
SHA51256f8c02688079fa910a5360487ed8692410dc3c087eb98d8aeb0f36148bdd9a22516227d5fae5385f9db6baa7db9667a613f0aac381d1d1f8f235b25b317b693
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD56e88a13e8cf1316d4da9c70d21ac6093
SHA1566d4aae6dd66be3248b11b35b2926a0a3f58718
SHA256d9c8e57a66c379e632028acc96d80cbe7ef3b0567eba70be567b2c2aaecf1427
SHA51242c5de8aa3bf7cadab6b89cce1150c00c807680927e11525c10b3218d2550c6866464421fd044f95c49fe8ceed014817c3238a1c0a84495b1abff9b5149bc528
-
Filesize
72KB
MD56e88a13e8cf1316d4da9c70d21ac6093
SHA1566d4aae6dd66be3248b11b35b2926a0a3f58718
SHA256d9c8e57a66c379e632028acc96d80cbe7ef3b0567eba70be567b2c2aaecf1427
SHA51242c5de8aa3bf7cadab6b89cce1150c00c807680927e11525c10b3218d2550c6866464421fd044f95c49fe8ceed014817c3238a1c0a84495b1abff9b5149bc528
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD554852466e55e6a2f48e07b3cb17ea55a
SHA1f9a6a38bd818d7cc0e4bf37988e792217c2952bb
SHA256c56a7bae6bb1778f13c8c70a9408d7a470eed077d557e58089b5795d872dedd6
SHA51252657d776b049ceec9b9f2380993988800a2db0c19ad0204baf4d6ac449450d666b31b683d46af39f42a05a985a9e643da9abc48c6a5b6a313007ca4ecc8d32b
-
Filesize
72KB
MD525cf1d0166cb58b1b55fe106bf4bb5e3
SHA1c7d0db4c8d3cd187f840110b0933cacd2c18f2ee
SHA25698a78d78a99f5ffb0abc58277a36bca13bf45f8d2e3b9d9ddb2f79ba0194529f
SHA5125d6fe2dbe97397becb2d5c7557c015dbff4811d94951ea34a637084045d905e541df2bbbabe72f29f833eb6315a7a4c7a0d181a5b58ca9cc6c7d146e089b64e8
-
Filesize
72KB
MD525cf1d0166cb58b1b55fe106bf4bb5e3
SHA1c7d0db4c8d3cd187f840110b0933cacd2c18f2ee
SHA25698a78d78a99f5ffb0abc58277a36bca13bf45f8d2e3b9d9ddb2f79ba0194529f
SHA5125d6fe2dbe97397becb2d5c7557c015dbff4811d94951ea34a637084045d905e541df2bbbabe72f29f833eb6315a7a4c7a0d181a5b58ca9cc6c7d146e089b64e8
-
Filesize
72KB
MD56f4c21363737836b8279af6c8165987d
SHA1762da69c221677388fbb3cd9263e6dbe1f1c0b61
SHA25695cf40d74042694bab049020094b51131d1700078f3485e4898b5a89aca7e104
SHA512c51869194b71fd4000501099ceecd2a7a1fd815621dc1d5238e9dbf3dcfc438bfb016fb4615aadead4b1f7ba2891aa13d22ed142408337d3d09f9647a8c2b70c
-
Filesize
72KB
MD56f4c21363737836b8279af6c8165987d
SHA1762da69c221677388fbb3cd9263e6dbe1f1c0b61
SHA25695cf40d74042694bab049020094b51131d1700078f3485e4898b5a89aca7e104
SHA512c51869194b71fd4000501099ceecd2a7a1fd815621dc1d5238e9dbf3dcfc438bfb016fb4615aadead4b1f7ba2891aa13d22ed142408337d3d09f9647a8c2b70c
-
Filesize
72KB
MD525cf1d0166cb58b1b55fe106bf4bb5e3
SHA1c7d0db4c8d3cd187f840110b0933cacd2c18f2ee
SHA25698a78d78a99f5ffb0abc58277a36bca13bf45f8d2e3b9d9ddb2f79ba0194529f
SHA5125d6fe2dbe97397becb2d5c7557c015dbff4811d94951ea34a637084045d905e541df2bbbabe72f29f833eb6315a7a4c7a0d181a5b58ca9cc6c7d146e089b64e8
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD5af47c4347cc4d2b5b7f89b5ae1db9370
SHA1a421035499bc28c382165e0ef77f8cb6d8155cbd
SHA2562c488379b6efb54d00bda33d5b44d50183e41873487ca8baf61ea4147196a890
SHA5127bf4a55322226a28b8beda73cb83ae723c5ee880a76a9aa20c7afa222fd0aee3a63393d5736309d71039f0e01834da787c7ce037b27c3f5bf6e656082a15a87d
-
Filesize
72KB
MD598333a455d6ef0a7a501578ae93927a0
SHA188273f6a8fbf985e0c8a749a64d0a15c201d1e49
SHA2561a3f8c691585abfca897a4347aadfa4de00acf4498d8de4aae4b8c4fefacf1a2
SHA512d759c7bc55a433fd9a6b57da0a888ee2f934df16a866d6861f5424077cc347ac9b5c073efd2c15d932b8f3308076c6fd6705b85fd90d3945f3c6cf4af7d781d3
-
Filesize
72KB
MD598333a455d6ef0a7a501578ae93927a0
SHA188273f6a8fbf985e0c8a749a64d0a15c201d1e49
SHA2561a3f8c691585abfca897a4347aadfa4de00acf4498d8de4aae4b8c4fefacf1a2
SHA512d759c7bc55a433fd9a6b57da0a888ee2f934df16a866d6861f5424077cc347ac9b5c073efd2c15d932b8f3308076c6fd6705b85fd90d3945f3c6cf4af7d781d3
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD5ebffb743124335505a4e56b474284f35
SHA1079a3133af415a5a23669af2d04698a87e7ee451
SHA256395fc4949de488543838a2c0b437eac11b4c49cd94d2642c79f18b6094eddda6
SHA512f8d9c973ce47d50dea1389772d2559e6209430f0383386175746febfae8df6bc6ecfb02387c26579c449c53e74f3bb9de7ae5b97e51f474fbfc32f1df2ba7150
-
Filesize
72KB
MD5ebffb743124335505a4e56b474284f35
SHA1079a3133af415a5a23669af2d04698a87e7ee451
SHA256395fc4949de488543838a2c0b437eac11b4c49cd94d2642c79f18b6094eddda6
SHA512f8d9c973ce47d50dea1389772d2559e6209430f0383386175746febfae8df6bc6ecfb02387c26579c449c53e74f3bb9de7ae5b97e51f474fbfc32f1df2ba7150
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD50d586b41ac1994aa56838bc9d8c0f0c1
SHA144f42c1dda054a65c397ed492ac7f610a5650c7c
SHA256006ca16611b3833fe230ed86134d25d23ef9ec0e1e2e079e104784f13da3afbf
SHA512c8446a8a190d2fa3c71cd3c1bc40f6e0a70186521896b5041ff1c33c7d2ff79a7a6e464fb9d64858b8ed32addc7ef664d7cf4e11c473453096b0feae5b118443
-
Filesize
72KB
MD5ebffb743124335505a4e56b474284f35
SHA1079a3133af415a5a23669af2d04698a87e7ee451
SHA256395fc4949de488543838a2c0b437eac11b4c49cd94d2642c79f18b6094eddda6
SHA512f8d9c973ce47d50dea1389772d2559e6209430f0383386175746febfae8df6bc6ecfb02387c26579c449c53e74f3bb9de7ae5b97e51f474fbfc32f1df2ba7150
-
Filesize
72KB
MD5ebffb743124335505a4e56b474284f35
SHA1079a3133af415a5a23669af2d04698a87e7ee451
SHA256395fc4949de488543838a2c0b437eac11b4c49cd94d2642c79f18b6094eddda6
SHA512f8d9c973ce47d50dea1389772d2559e6209430f0383386175746febfae8df6bc6ecfb02387c26579c449c53e74f3bb9de7ae5b97e51f474fbfc32f1df2ba7150