Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
200s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe
Resource
win10v2004-20221111-en
General
-
Target
35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe
-
Size
72KB
-
MD5
023457d70aee38eb4431b2b99063d814
-
SHA1
1104c468ea90ce907bcbdcceb62238f7fee3781f
-
SHA256
35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a
-
SHA512
1fa4eef0089e2c45681e337180a430257060ef5fddb7d9ee8ebfd00a96018d8d6c0e368b10ae1bee965e02b3cd42023c6144c039c5db7ab45b6e4927f43f6fde
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2B:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPV
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 960 backup.exe 1644 backup.exe 1544 backup.exe 1412 backup.exe 1832 backup.exe 468 backup.exe 304 backup.exe 292 update.exe 2020 backup.exe 1988 backup.exe 1816 backup.exe 896 backup.exe 336 System Restore.exe 1384 backup.exe 1984 backup.exe 316 backup.exe 1252 data.exe 1728 backup.exe 608 backup.exe 860 backup.exe 1868 backup.exe 1660 backup.exe 524 backup.exe 1176 backup.exe 1372 backup.exe 1008 backup.exe 648 backup.exe 1196 backup.exe 1988 backup.exe 1740 backup.exe 952 backup.exe 2000 backup.exe 1148 backup.exe 1844 backup.exe 1152 backup.exe 1820 backup.exe 1616 backup.exe 1208 backup.exe 836 backup.exe 1644 System Restore.exe 520 backup.exe 1172 backup.exe 992 backup.exe 284 backup.exe 304 backup.exe 1688 backup.exe 1872 backup.exe 1176 backup.exe 1008 update.exe 1964 backup.exe 2020 backup.exe 968 backup.exe 432 System Restore.exe 1592 backup.exe 1780 backup.exe 1620 backup.exe 988 backup.exe 336 backup.exe 1020 backup.exe 1752 backup.exe 1572 backup.exe 1064 backup.exe 1352 backup.exe 1528 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 292 update.exe 292 update.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 1988 backup.exe 1988 backup.exe 1988 backup.exe 292 update.exe 292 update.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 1816 backup.exe 896 backup.exe 896 backup.exe 896 backup.exe 896 backup.exe 896 backup.exe 336 System Restore.exe 336 System Restore.exe 336 System Restore.exe 1816 backup.exe 1816 backup.exe 1384 backup.exe 1384 backup.exe 1384 backup.exe 1384 backup.exe 1384 backup.exe 1984 backup.exe 1984 backup.exe 1984 backup.exe 1984 backup.exe 1984 backup.exe 316 backup.exe 316 backup.exe 316 backup.exe 1984 backup.exe 1984 backup.exe 1252 data.exe 1252 data.exe 1252 data.exe 1252 data.exe 1252 data.exe 1728 backup.exe 1728 backup.exe 1728 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe data.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\data.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe data.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe update.exe File opened for modification C:\Windows\addins\data.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 960 backup.exe 1644 backup.exe 1544 backup.exe 1412 backup.exe 1832 backup.exe 468 backup.exe 304 backup.exe 292 update.exe 2020 backup.exe 1988 backup.exe 1816 backup.exe 896 backup.exe 336 System Restore.exe 1384 backup.exe 1984 backup.exe 316 backup.exe 1252 data.exe 1728 backup.exe 608 backup.exe 860 backup.exe 1868 backup.exe 1660 backup.exe 524 backup.exe 1176 backup.exe 1372 backup.exe 1008 backup.exe 648 backup.exe 1196 backup.exe 1988 backup.exe 1740 backup.exe 952 backup.exe 2000 backup.exe 1148 backup.exe 1844 backup.exe 1152 backup.exe 1820 backup.exe 1616 backup.exe 1208 backup.exe 520 backup.exe 836 backup.exe 1644 System Restore.exe 1172 backup.exe 284 backup.exe 992 backup.exe 304 backup.exe 1872 backup.exe 1688 backup.exe 1176 backup.exe 1008 update.exe 1964 backup.exe 2020 backup.exe 968 backup.exe 432 System Restore.exe 1592 backup.exe 1780 backup.exe 336 backup.exe 1020 backup.exe 1752 backup.exe 1572 backup.exe 1064 backup.exe 1528 backup.exe 1232 backup.exe 1352 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 960 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 28 PID 1108 wrote to memory of 960 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 28 PID 1108 wrote to memory of 960 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 28 PID 1108 wrote to memory of 960 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 28 PID 1108 wrote to memory of 1644 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 29 PID 1108 wrote to memory of 1644 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 29 PID 1108 wrote to memory of 1644 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 29 PID 1108 wrote to memory of 1644 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 29 PID 1108 wrote to memory of 1544 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 30 PID 1108 wrote to memory of 1544 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 30 PID 1108 wrote to memory of 1544 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 30 PID 1108 wrote to memory of 1544 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 30 PID 1108 wrote to memory of 1412 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 31 PID 1108 wrote to memory of 1412 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 31 PID 1108 wrote to memory of 1412 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 31 PID 1108 wrote to memory of 1412 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 31 PID 1108 wrote to memory of 1832 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 32 PID 1108 wrote to memory of 1832 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 32 PID 1108 wrote to memory of 1832 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 32 PID 1108 wrote to memory of 1832 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 32 PID 1108 wrote to memory of 468 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 33 PID 1108 wrote to memory of 468 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 33 PID 1108 wrote to memory of 468 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 33 PID 1108 wrote to memory of 468 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 33 PID 1108 wrote to memory of 304 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 34 PID 1108 wrote to memory of 304 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 34 PID 1108 wrote to memory of 304 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 34 PID 1108 wrote to memory of 304 1108 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe 34 PID 960 wrote to memory of 292 960 backup.exe 35 PID 960 wrote to memory of 292 960 backup.exe 35 PID 960 wrote to memory of 292 960 backup.exe 35 PID 960 wrote to memory of 292 960 backup.exe 35 PID 960 wrote to memory of 292 960 backup.exe 35 PID 960 wrote to memory of 292 960 backup.exe 35 PID 960 wrote to memory of 292 960 backup.exe 35 PID 292 wrote to memory of 2020 292 update.exe 36 PID 292 wrote to memory of 2020 292 update.exe 36 PID 292 wrote to memory of 2020 292 update.exe 36 PID 292 wrote to memory of 2020 292 update.exe 36 PID 292 wrote to memory of 2020 292 update.exe 36 PID 292 wrote to memory of 2020 292 update.exe 36 PID 292 wrote to memory of 2020 292 update.exe 36 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 2020 wrote to memory of 1988 2020 backup.exe 37 PID 292 wrote to memory of 1816 292 update.exe 38 PID 292 wrote to memory of 1816 292 update.exe 38 PID 292 wrote to memory of 1816 292 update.exe 38 PID 292 wrote to memory of 1816 292 update.exe 38 PID 292 wrote to memory of 1816 292 update.exe 38 PID 292 wrote to memory of 1816 292 update.exe 38 PID 292 wrote to memory of 1816 292 update.exe 38 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 1816 wrote to memory of 896 1816 backup.exe 39 PID 896 wrote to memory of 336 896 backup.exe 40 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe"C:\Users\Admin\AppData\Local\Temp\35683740082d9d1598ff9bb34553468caf86c5e97dd73a57d1086a045178475a.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\1386266715\backup.exeC:\Users\Admin\AppData\Local\Temp\1386266715\backup.exe C:\Users\Admin\AppData\Local\Temp\1386266715\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:960 -
C:\update.exe\update.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:292 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1988
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:896 -
C:\Program Files\7-Zip\Lang\System Restore.exe"C:\Program Files\7-Zip\Lang\System Restore.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:336
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:316
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1252 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:608
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:860
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1660
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1372
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1988 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1148
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:768
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1756
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1204
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:1304
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:2068
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1820 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1208
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:284
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:988
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1572
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1232 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:632
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1200
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1352
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1460
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1616 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:992
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:304 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1020 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1200
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1764
-
-
C:\Program Files\Common Files\System\ado\fr-FR\update.exe"C:\Program Files\Common Files\System\ado\fr-FR\update.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1940
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:804
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:2032
-
-
-
C:\Program Files\Common Files\System\de-DE\data.exe"C:\Program Files\Common Files\System\de-DE\data.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
PID:1964
-
-
C:\Program Files\Common Files\System\en-US\System Restore.exe"C:\Program Files\Common Files\System\en-US\System Restore.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1064
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:520
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1824
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1988
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2052
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1152 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:520
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1688
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:520
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2020
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:1688
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵PID:1684
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:968 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:268 -
C:\Program Files\Google\Chrome\Application\data.exe"C:\Program Files\Google\Chrome\Application\data.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:2088
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1560
-
-
C:\Program Files\Java\data.exe"C:\Program Files\Java\data.exe" C:\Program Files\Java\5⤵PID:1956
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:868
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:952 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:836 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1176 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
PID:1620
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1548 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1492 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵PID:2012
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:576
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:188
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1716
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1724 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1372
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1396
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1644
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1516
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1400
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:584 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:792
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
PID:1824
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
PID:1616
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:2004
-
-
C:\Users\Admin\Favorites\update.exeC:\Users\Admin\Favorites\update.exe C:\Users\Admin\Favorites\6⤵PID:1732
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:300
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:860 -
C:\Users\Public\Documents\data.exeC:\Users\Public\Documents\data.exe C:\Users\Public\Documents\6⤵PID:1760
-
-
C:\Users\Public\Downloads\System Restore.exe"C:\Users\Public\Downloads\System Restore.exe" C:\Users\Public\Downloads\6⤵PID:828
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:836
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
PID:1740 -
C:\Windows\addins\data.exeC:\Windows\addins\data.exe C:\Windows\addins\5⤵PID:1600
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1712
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1196
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2060
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1412
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:304
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD59c5e9ee594d88a0aa2f7d3337c8ce5a7
SHA17743b46ed2aece30e8e8ad080ef3e03e771841b5
SHA256acee7dc3110580cf3198b0d56430d88f7773d8a528ae334bea125b851250b03c
SHA512d15249465064c857c682d78fbb18c748bdcb3a2f6a339010ba295b12f109b5f85465e2dcea9a784045bcef65e086950f6528dcf8714d27f83d00f78512c7b01e
-
Filesize
72KB
MD59c5e9ee594d88a0aa2f7d3337c8ce5a7
SHA17743b46ed2aece30e8e8ad080ef3e03e771841b5
SHA256acee7dc3110580cf3198b0d56430d88f7773d8a528ae334bea125b851250b03c
SHA512d15249465064c857c682d78fbb18c748bdcb3a2f6a339010ba295b12f109b5f85465e2dcea9a784045bcef65e086950f6528dcf8714d27f83d00f78512c7b01e
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD5473962120f7b38e55191497b549042d4
SHA179067bc703126952276a0adcc32a1404637803c1
SHA2561b4951da98ca7566184decf2646c9dda0129ee8a50976fe677445669493e765b
SHA51235056aacefdde22224d59e3c63d9fee903cf14bcfb236ea26f4db438cec34a65547256d0b56705fe5e30b5a4d004112d88ada6fce62be9b60e8412035376434b
-
Filesize
72KB
MD5473962120f7b38e55191497b549042d4
SHA179067bc703126952276a0adcc32a1404637803c1
SHA2561b4951da98ca7566184decf2646c9dda0129ee8a50976fe677445669493e765b
SHA51235056aacefdde22224d59e3c63d9fee903cf14bcfb236ea26f4db438cec34a65547256d0b56705fe5e30b5a4d004112d88ada6fce62be9b60e8412035376434b
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD599f3b29ab15ce27b4d96d615edc0374a
SHA13567d8a7ec521cce51666bde38752139d929227b
SHA25683e3bc3561e6093912769778e829c4c019e01f4662b2a239147a7fb39d1b546a
SHA512cf92c245240797e0908c97f4b9c81608da3a86700f8b68b81d63eb05c6cf54fefc9178e6c0bd80540296798fa692cd717232e449edb157556bf9be61f4d33da7
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD57c6ff17cbc4a920606475182799e9ee3
SHA1f2daf3da8c6285bc0ceb5b0a3df194b8f174dd96
SHA256e1e7ada3197ed13315ade159bed1502e0cb01ac265248b498a22ea2e48709c99
SHA512173771f9ea21a57b967ff86b7a1da8cd7ba7a60e36bfb0fccb171986f16007f2bf378af3b715590d58d1193975d6c660d2ea62f17f1636bb697ee354c67ae3ba
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD581c9b15544b308c5dddf9660889d2de4
SHA1076e8f2a61e8db4f459a9e6175fc01ffe662b7b9
SHA25685591c4cf22a46731ff67c1e982f573c2ddc18e9205a926dee665f83db7978f9
SHA5121accc85ac764d4fdf45ad318c7aed61a4f2ff69a9cbcedb7b81eeb98c9e51fb8cbb2ed5fa76d8531bed5c179b5b13c171ad6ad6a189dac13d017735c4c37c317
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD50da89204b31dcbb36e0acf6368cb7631
SHA15634ccfc4e4a41b0ae4bf7888ae66f2cf4da10b4
SHA256f218760a6f1fc8127513a8b87e82f7a3527c82e8767d5c5ffbd264fdb2337150
SHA51299e3d390b4875b4e67af1c9df0eafb2bb2294209e6f4ec0642b4a73e1cd179ca21c895a5ca5dfb06042315cd5992afcce5f0357cc615d6d17ffe303d6ad7b651
-
Filesize
72KB
MD59c5e9ee594d88a0aa2f7d3337c8ce5a7
SHA17743b46ed2aece30e8e8ad080ef3e03e771841b5
SHA256acee7dc3110580cf3198b0d56430d88f7773d8a528ae334bea125b851250b03c
SHA512d15249465064c857c682d78fbb18c748bdcb3a2f6a339010ba295b12f109b5f85465e2dcea9a784045bcef65e086950f6528dcf8714d27f83d00f78512c7b01e
-
Filesize
72KB
MD59c5e9ee594d88a0aa2f7d3337c8ce5a7
SHA17743b46ed2aece30e8e8ad080ef3e03e771841b5
SHA256acee7dc3110580cf3198b0d56430d88f7773d8a528ae334bea125b851250b03c
SHA512d15249465064c857c682d78fbb18c748bdcb3a2f6a339010ba295b12f109b5f85465e2dcea9a784045bcef65e086950f6528dcf8714d27f83d00f78512c7b01e
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059
-
Filesize
72KB
MD50200f0dfb6678693349c595a6b9944f6
SHA103bfb5a5ed30f86e95b249134193a4be34f4cd35
SHA256c4a6bd3b8d10358d768b27ea3b2fa45cfbffba2723fb3472ca70142622b430fa
SHA512eb755d345b3b2cd416951d2e428575ed183bacd027f37fad171e250b38cfb8063ab125d2ba47b0491a4784f5b4332cdfd6d2bd5b691e5d0cea523ab112bbb059